Merge branch 'hwmon-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6
[linux-2.6] / drivers / char / tty_io.c
1 /*
2  *  linux/drivers/char/tty_io.c
3  *
4  *  Copyright (C) 1991, 1992  Linus Torvalds
5  */
6
7 /*
8  * 'tty_io.c' gives an orthogonal feeling to tty's, be they consoles
9  * or rs-channels. It also implements echoing, cooked mode etc.
10  *
11  * Kill-line thanks to John T Kohl, who also corrected VMIN = VTIME = 0.
12  *
13  * Modified by Theodore Ts'o, 9/14/92, to dynamically allocate the
14  * tty_struct and tty_queue structures.  Previously there was an array
15  * of 256 tty_struct's which was statically allocated, and the
16  * tty_queue structures were allocated at boot time.  Both are now
17  * dynamically allocated only when the tty is open.
18  *
19  * Also restructured routines so that there is more of a separation
20  * between the high-level tty routines (tty_io.c and tty_ioctl.c) and
21  * the low-level tty routines (serial.c, pty.c, console.c).  This
22  * makes for cleaner and more compact code.  -TYT, 9/17/92 
23  *
24  * Modified by Fred N. van Kempen, 01/29/93, to add line disciplines
25  * which can be dynamically activated and de-activated by the line
26  * discipline handling modules (like SLIP).
27  *
28  * NOTE: pay no attention to the line discipline code (yet); its
29  * interface is still subject to change in this version...
30  * -- TYT, 1/31/92
31  *
32  * Added functionality to the OPOST tty handling.  No delays, but all
33  * other bits should be there.
34  *      -- Nick Holloway <alfie@dcs.warwick.ac.uk>, 27th May 1993.
35  *
36  * Rewrote canonical mode and added more termios flags.
37  *      -- julian@uhunix.uhcc.hawaii.edu (J. Cowley), 13Jan94
38  *
39  * Reorganized FASYNC support so mouse code can share it.
40  *      -- ctm@ardi.com, 9Sep95
41  *
42  * New TIOCLINUX variants added.
43  *      -- mj@k332.feld.cvut.cz, 19-Nov-95
44  * 
45  * Restrict vt switching via ioctl()
46  *      -- grif@cs.ucr.edu, 5-Dec-95
47  *
48  * Move console and virtual terminal code to more appropriate files,
49  * implement CONFIG_VT and generalize console device interface.
50  *      -- Marko Kohtala <Marko.Kohtala@hut.fi>, March 97
51  *
52  * Rewrote init_dev and release_dev to eliminate races.
53  *      -- Bill Hawes <whawes@star.net>, June 97
54  *
55  * Added devfs support.
56  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 13-Jan-1998
57  *
58  * Added support for a Unix98-style ptmx device.
59  *      -- C. Scott Ananian <cananian@alumni.princeton.edu>, 14-Jan-1998
60  *
61  * Reduced memory usage for older ARM systems
62  *      -- Russell King <rmk@arm.linux.org.uk>
63  *
64  * Move do_SAK() into process context.  Less stack use in devfs functions.
65  * alloc_tty_struct() always uses kmalloc() -- Andrew Morton <andrewm@uow.edu.eu> 17Mar01
66  */
67
68 #include <linux/types.h>
69 #include <linux/major.h>
70 #include <linux/errno.h>
71 #include <linux/signal.h>
72 #include <linux/fcntl.h>
73 #include <linux/sched.h>
74 #include <linux/interrupt.h>
75 #include <linux/tty.h>
76 #include <linux/tty_driver.h>
77 #include <linux/tty_flip.h>
78 #include <linux/devpts_fs.h>
79 #include <linux/file.h>
80 #include <linux/console.h>
81 #include <linux/timer.h>
82 #include <linux/ctype.h>
83 #include <linux/kd.h>
84 #include <linux/mm.h>
85 #include <linux/string.h>
86 #include <linux/slab.h>
87 #include <linux/poll.h>
88 #include <linux/proc_fs.h>
89 #include <linux/init.h>
90 #include <linux/module.h>
91 #include <linux/smp_lock.h>
92 #include <linux/device.h>
93 #include <linux/idr.h>
94 #include <linux/wait.h>
95 #include <linux/bitops.h>
96 #include <linux/delay.h>
97
98 #include <asm/uaccess.h>
99 #include <asm/system.h>
100
101 #include <linux/kbd_kern.h>
102 #include <linux/vt_kern.h>
103 #include <linux/selection.h>
104
105 #include <linux/kmod.h>
106
107 #undef TTY_DEBUG_HANGUP
108
109 #define TTY_PARANOIA_CHECK 1
110 #define CHECK_TTY_COUNT 1
111
112 struct ktermios tty_std_termios = {     /* for the benefit of tty drivers  */
113         .c_iflag = ICRNL | IXON,
114         .c_oflag = OPOST | ONLCR,
115         .c_cflag = B38400 | CS8 | CREAD | HUPCL,
116         .c_lflag = ISIG | ICANON | ECHO | ECHOE | ECHOK |
117                    ECHOCTL | ECHOKE | IEXTEN,
118         .c_cc = INIT_C_CC,
119         .c_ispeed = 38400,
120         .c_ospeed = 38400
121 };
122
123 EXPORT_SYMBOL(tty_std_termios);
124
125 /* This list gets poked at by procfs and various bits of boot up code. This
126    could do with some rationalisation such as pulling the tty proc function
127    into this file */
128    
129 LIST_HEAD(tty_drivers);                 /* linked list of tty drivers */
130
131 /* Mutex to protect creating and releasing a tty. This is shared with
132    vt.c for deeply disgusting hack reasons */
133 DEFINE_MUTEX(tty_mutex);
134 EXPORT_SYMBOL(tty_mutex);
135
136 #ifdef CONFIG_UNIX98_PTYS
137 extern struct tty_driver *ptm_driver;   /* Unix98 pty masters; for /dev/ptmx */
138 extern int pty_limit;           /* Config limit on Unix98 ptys */
139 static DEFINE_IDR(allocated_ptys);
140 static DECLARE_MUTEX(allocated_ptys_lock);
141 static int ptmx_open(struct inode *, struct file *);
142 #endif
143
144 extern void disable_early_printk(void);
145
146 static void initialize_tty_struct(struct tty_struct *tty);
147
148 static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
149 static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
150 ssize_t redirected_tty_write(struct file *, const char __user *, size_t, loff_t *);
151 static unsigned int tty_poll(struct file *, poll_table *);
152 static int tty_open(struct inode *, struct file *);
153 static int tty_release(struct inode *, struct file *);
154 int tty_ioctl(struct inode * inode, struct file * file,
155               unsigned int cmd, unsigned long arg);
156 static int tty_fasync(int fd, struct file * filp, int on);
157 static void release_mem(struct tty_struct *tty, int idx);
158
159 /**
160  *      alloc_tty_struct        -       allocate a tty object
161  *
162  *      Return a new empty tty structure. The data fields have not
163  *      been initialized in any way but has been zeroed
164  *
165  *      Locking: none
166  */
167
168 static struct tty_struct *alloc_tty_struct(void)
169 {
170         return kzalloc(sizeof(struct tty_struct), GFP_KERNEL);
171 }
172
173 static void tty_buffer_free_all(struct tty_struct *);
174
175 /**
176  *      free_tty_struct         -       free a disused tty
177  *      @tty: tty struct to free
178  *
179  *      Free the write buffers, tty queue and tty memory itself.
180  *
181  *      Locking: none. Must be called after tty is definitely unused
182  */
183
184 static inline void free_tty_struct(struct tty_struct *tty)
185 {
186         kfree(tty->write_buf);
187         tty_buffer_free_all(tty);
188         kfree(tty);
189 }
190
191 #define TTY_NUMBER(tty) ((tty)->index + (tty)->driver->name_base)
192
193 /**
194  *      tty_name        -       return tty naming
195  *      @tty: tty structure
196  *      @buf: buffer for output
197  *
198  *      Convert a tty structure into a name. The name reflects the kernel
199  *      naming policy and if udev is in use may not reflect user space
200  *
201  *      Locking: none
202  */
203
204 char *tty_name(struct tty_struct *tty, char *buf)
205 {
206         if (!tty) /* Hmm.  NULL pointer.  That's fun. */
207                 strcpy(buf, "NULL tty");
208         else
209                 strcpy(buf, tty->name);
210         return buf;
211 }
212
213 EXPORT_SYMBOL(tty_name);
214
215 int tty_paranoia_check(struct tty_struct *tty, struct inode *inode,
216                               const char *routine)
217 {
218 #ifdef TTY_PARANOIA_CHECK
219         if (!tty) {
220                 printk(KERN_WARNING
221                         "null TTY for (%d:%d) in %s\n",
222                         imajor(inode), iminor(inode), routine);
223                 return 1;
224         }
225         if (tty->magic != TTY_MAGIC) {
226                 printk(KERN_WARNING
227                         "bad magic number for tty struct (%d:%d) in %s\n",
228                         imajor(inode), iminor(inode), routine);
229                 return 1;
230         }
231 #endif
232         return 0;
233 }
234
235 static int check_tty_count(struct tty_struct *tty, const char *routine)
236 {
237 #ifdef CHECK_TTY_COUNT
238         struct list_head *p;
239         int count = 0;
240         
241         file_list_lock();
242         list_for_each(p, &tty->tty_files) {
243                 count++;
244         }
245         file_list_unlock();
246         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
247             tty->driver->subtype == PTY_TYPE_SLAVE &&
248             tty->link && tty->link->count)
249                 count++;
250         if (tty->count != count) {
251                 printk(KERN_WARNING "Warning: dev (%s) tty->count(%d) "
252                                     "!= #fd's(%d) in %s\n",
253                        tty->name, tty->count, count, routine);
254                 return count;
255         }
256 #endif
257         return 0;
258 }
259
260 /*
261  * Tty buffer allocation management
262  */
263
264 /**
265  *      tty_buffer_free_all             -       free buffers used by a tty
266  *      @tty: tty to free from
267  *
268  *      Remove all the buffers pending on a tty whether queued with data
269  *      or in the free ring. Must be called when the tty is no longer in use
270  *
271  *      Locking: none
272  */
273
274 static void tty_buffer_free_all(struct tty_struct *tty)
275 {
276         struct tty_buffer *thead;
277         while((thead = tty->buf.head) != NULL) {
278                 tty->buf.head = thead->next;
279                 kfree(thead);
280         }
281         while((thead = tty->buf.free) != NULL) {
282                 tty->buf.free = thead->next;
283                 kfree(thead);
284         }
285         tty->buf.tail = NULL;
286         tty->buf.memory_used = 0;
287 }
288
289 /**
290  *      tty_buffer_init         -       prepare a tty buffer structure
291  *      @tty: tty to initialise
292  *
293  *      Set up the initial state of the buffer management for a tty device.
294  *      Must be called before the other tty buffer functions are used.
295  *
296  *      Locking: none
297  */
298
299 static void tty_buffer_init(struct tty_struct *tty)
300 {
301         spin_lock_init(&tty->buf.lock);
302         tty->buf.head = NULL;
303         tty->buf.tail = NULL;
304         tty->buf.free = NULL;
305         tty->buf.memory_used = 0;
306 }
307
308 /**
309  *      tty_buffer_alloc        -       allocate a tty buffer
310  *      @tty: tty device
311  *      @size: desired size (characters)
312  *
313  *      Allocate a new tty buffer to hold the desired number of characters.
314  *      Return NULL if out of memory or the allocation would exceed the
315  *      per device queue
316  *
317  *      Locking: Caller must hold tty->buf.lock
318  */
319
320 static struct tty_buffer *tty_buffer_alloc(struct tty_struct *tty, size_t size)
321 {
322         struct tty_buffer *p;
323
324         if (tty->buf.memory_used + size > 65536)
325                 return NULL;
326         p = kmalloc(sizeof(struct tty_buffer) + 2 * size, GFP_ATOMIC);
327         if(p == NULL)
328                 return NULL;
329         p->used = 0;
330         p->size = size;
331         p->next = NULL;
332         p->commit = 0;
333         p->read = 0;
334         p->char_buf_ptr = (char *)(p->data);
335         p->flag_buf_ptr = (unsigned char *)p->char_buf_ptr + size;
336         tty->buf.memory_used += size;
337         return p;
338 }
339
340 /**
341  *      tty_buffer_free         -       free a tty buffer
342  *      @tty: tty owning the buffer
343  *      @b: the buffer to free
344  *
345  *      Free a tty buffer, or add it to the free list according to our
346  *      internal strategy
347  *
348  *      Locking: Caller must hold tty->buf.lock
349  */
350
351 static void tty_buffer_free(struct tty_struct *tty, struct tty_buffer *b)
352 {
353         /* Dumb strategy for now - should keep some stats */
354         tty->buf.memory_used -= b->size;
355         WARN_ON(tty->buf.memory_used < 0);
356
357         if(b->size >= 512)
358                 kfree(b);
359         else {
360                 b->next = tty->buf.free;
361                 tty->buf.free = b;
362         }
363 }
364
365 /**
366  *      tty_buffer_find         -       find a free tty buffer
367  *      @tty: tty owning the buffer
368  *      @size: characters wanted
369  *
370  *      Locate an existing suitable tty buffer or if we are lacking one then
371  *      allocate a new one. We round our buffers off in 256 character chunks
372  *      to get better allocation behaviour.
373  *
374  *      Locking: Caller must hold tty->buf.lock
375  */
376
377 static struct tty_buffer *tty_buffer_find(struct tty_struct *tty, size_t size)
378 {
379         struct tty_buffer **tbh = &tty->buf.free;
380         while((*tbh) != NULL) {
381                 struct tty_buffer *t = *tbh;
382                 if(t->size >= size) {
383                         *tbh = t->next;
384                         t->next = NULL;
385                         t->used = 0;
386                         t->commit = 0;
387                         t->read = 0;
388                         tty->buf.memory_used += t->size;
389                         return t;
390                 }
391                 tbh = &((*tbh)->next);
392         }
393         /* Round the buffer size out */
394         size = (size + 0xFF) & ~ 0xFF;
395         return tty_buffer_alloc(tty, size);
396         /* Should possibly check if this fails for the largest buffer we
397            have queued and recycle that ? */
398 }
399
400 /**
401  *      tty_buffer_request_room         -       grow tty buffer if needed
402  *      @tty: tty structure
403  *      @size: size desired
404  *
405  *      Make at least size bytes of linear space available for the tty
406  *      buffer. If we fail return the size we managed to find.
407  *
408  *      Locking: Takes tty->buf.lock
409  */
410 int tty_buffer_request_room(struct tty_struct *tty, size_t size)
411 {
412         struct tty_buffer *b, *n;
413         int left;
414         unsigned long flags;
415
416         spin_lock_irqsave(&tty->buf.lock, flags);
417
418         /* OPTIMISATION: We could keep a per tty "zero" sized buffer to
419            remove this conditional if its worth it. This would be invisible
420            to the callers */
421         if ((b = tty->buf.tail) != NULL)
422                 left = b->size - b->used;
423         else
424                 left = 0;
425
426         if (left < size) {
427                 /* This is the slow path - looking for new buffers to use */
428                 if ((n = tty_buffer_find(tty, size)) != NULL) {
429                         if (b != NULL) {
430                                 b->next = n;
431                                 b->commit = b->used;
432                         } else
433                                 tty->buf.head = n;
434                         tty->buf.tail = n;
435                 } else
436                         size = left;
437         }
438
439         spin_unlock_irqrestore(&tty->buf.lock, flags);
440         return size;
441 }
442 EXPORT_SYMBOL_GPL(tty_buffer_request_room);
443
444 /**
445  *      tty_insert_flip_string  -       Add characters to the tty buffer
446  *      @tty: tty structure
447  *      @chars: characters
448  *      @size: size
449  *
450  *      Queue a series of bytes to the tty buffering. All the characters
451  *      passed are marked as without error. Returns the number added.
452  *
453  *      Locking: Called functions may take tty->buf.lock
454  */
455
456 int tty_insert_flip_string(struct tty_struct *tty, const unsigned char *chars,
457                                 size_t size)
458 {
459         int copied = 0;
460         do {
461                 int space = tty_buffer_request_room(tty, size - copied);
462                 struct tty_buffer *tb = tty->buf.tail;
463                 /* If there is no space then tb may be NULL */
464                 if(unlikely(space == 0))
465                         break;
466                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
467                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
468                 tb->used += space;
469                 copied += space;
470                 chars += space;
471                 /* There is a small chance that we need to split the data over
472                    several buffers. If this is the case we must loop */
473         } while (unlikely(size > copied));
474         return copied;
475 }
476 EXPORT_SYMBOL(tty_insert_flip_string);
477
478 /**
479  *      tty_insert_flip_string_flags    -       Add characters to the tty buffer
480  *      @tty: tty structure
481  *      @chars: characters
482  *      @flags: flag bytes
483  *      @size: size
484  *
485  *      Queue a series of bytes to the tty buffering. For each character
486  *      the flags array indicates the status of the character. Returns the
487  *      number added.
488  *
489  *      Locking: Called functions may take tty->buf.lock
490  */
491
492 int tty_insert_flip_string_flags(struct tty_struct *tty,
493                 const unsigned char *chars, const char *flags, size_t size)
494 {
495         int copied = 0;
496         do {
497                 int space = tty_buffer_request_room(tty, size - copied);
498                 struct tty_buffer *tb = tty->buf.tail;
499                 /* If there is no space then tb may be NULL */
500                 if(unlikely(space == 0))
501                         break;
502                 memcpy(tb->char_buf_ptr + tb->used, chars, space);
503                 memcpy(tb->flag_buf_ptr + tb->used, flags, space);
504                 tb->used += space;
505                 copied += space;
506                 chars += space;
507                 flags += space;
508                 /* There is a small chance that we need to split the data over
509                    several buffers. If this is the case we must loop */
510         } while (unlikely(size > copied));
511         return copied;
512 }
513 EXPORT_SYMBOL(tty_insert_flip_string_flags);
514
515 /**
516  *      tty_schedule_flip       -       push characters to ldisc
517  *      @tty: tty to push from
518  *
519  *      Takes any pending buffers and transfers their ownership to the
520  *      ldisc side of the queue. It then schedules those characters for
521  *      processing by the line discipline.
522  *
523  *      Locking: Takes tty->buf.lock
524  */
525
526 void tty_schedule_flip(struct tty_struct *tty)
527 {
528         unsigned long flags;
529         spin_lock_irqsave(&tty->buf.lock, flags);
530         if (tty->buf.tail != NULL)
531                 tty->buf.tail->commit = tty->buf.tail->used;
532         spin_unlock_irqrestore(&tty->buf.lock, flags);
533         schedule_delayed_work(&tty->buf.work, 1);
534 }
535 EXPORT_SYMBOL(tty_schedule_flip);
536
537 /**
538  *      tty_prepare_flip_string         -       make room for characters
539  *      @tty: tty
540  *      @chars: return pointer for character write area
541  *      @size: desired size
542  *
543  *      Prepare a block of space in the buffer for data. Returns the length
544  *      available and buffer pointer to the space which is now allocated and
545  *      accounted for as ready for normal characters. This is used for drivers
546  *      that need their own block copy routines into the buffer. There is no
547  *      guarantee the buffer is a DMA target!
548  *
549  *      Locking: May call functions taking tty->buf.lock
550  */
551
552 int tty_prepare_flip_string(struct tty_struct *tty, unsigned char **chars, size_t size)
553 {
554         int space = tty_buffer_request_room(tty, size);
555         if (likely(space)) {
556                 struct tty_buffer *tb = tty->buf.tail;
557                 *chars = tb->char_buf_ptr + tb->used;
558                 memset(tb->flag_buf_ptr + tb->used, TTY_NORMAL, space);
559                 tb->used += space;
560         }
561         return space;
562 }
563
564 EXPORT_SYMBOL_GPL(tty_prepare_flip_string);
565
566 /**
567  *      tty_prepare_flip_string_flags   -       make room for characters
568  *      @tty: tty
569  *      @chars: return pointer for character write area
570  *      @flags: return pointer for status flag write area
571  *      @size: desired size
572  *
573  *      Prepare a block of space in the buffer for data. Returns the length
574  *      available and buffer pointer to the space which is now allocated and
575  *      accounted for as ready for characters. This is used for drivers
576  *      that need their own block copy routines into the buffer. There is no
577  *      guarantee the buffer is a DMA target!
578  *
579  *      Locking: May call functions taking tty->buf.lock
580  */
581
582 int tty_prepare_flip_string_flags(struct tty_struct *tty, unsigned char **chars, char **flags, size_t size)
583 {
584         int space = tty_buffer_request_room(tty, size);
585         if (likely(space)) {
586                 struct tty_buffer *tb = tty->buf.tail;
587                 *chars = tb->char_buf_ptr + tb->used;
588                 *flags = tb->flag_buf_ptr + tb->used;
589                 tb->used += space;
590         }
591         return space;
592 }
593
594 EXPORT_SYMBOL_GPL(tty_prepare_flip_string_flags);
595
596
597
598 /**
599  *      tty_set_termios_ldisc           -       set ldisc field
600  *      @tty: tty structure
601  *      @num: line discipline number
602  *
603  *      This is probably overkill for real world processors but
604  *      they are not on hot paths so a little discipline won't do 
605  *      any harm.
606  *
607  *      Locking: takes termios_mutex
608  */
609  
610 static void tty_set_termios_ldisc(struct tty_struct *tty, int num)
611 {
612         mutex_lock(&tty->termios_mutex);
613         tty->termios->c_line = num;
614         mutex_unlock(&tty->termios_mutex);
615 }
616
617 /*
618  *      This guards the refcounted line discipline lists. The lock
619  *      must be taken with irqs off because there are hangup path
620  *      callers who will do ldisc lookups and cannot sleep.
621  */
622  
623 static DEFINE_SPINLOCK(tty_ldisc_lock);
624 static DECLARE_WAIT_QUEUE_HEAD(tty_ldisc_wait);
625 static struct tty_ldisc tty_ldiscs[NR_LDISCS];  /* line disc dispatch table */
626
627 /**
628  *      tty_register_ldisc      -       install a line discipline
629  *      @disc: ldisc number
630  *      @new_ldisc: pointer to the ldisc object
631  *
632  *      Installs a new line discipline into the kernel. The discipline
633  *      is set up as unreferenced and then made available to the kernel
634  *      from this point onwards.
635  *
636  *      Locking:
637  *              takes tty_ldisc_lock to guard against ldisc races
638  */
639
640 int tty_register_ldisc(int disc, struct tty_ldisc *new_ldisc)
641 {
642         unsigned long flags;
643         int ret = 0;
644         
645         if (disc < N_TTY || disc >= NR_LDISCS)
646                 return -EINVAL;
647         
648         spin_lock_irqsave(&tty_ldisc_lock, flags);
649         tty_ldiscs[disc] = *new_ldisc;
650         tty_ldiscs[disc].num = disc;
651         tty_ldiscs[disc].flags |= LDISC_FLAG_DEFINED;
652         tty_ldiscs[disc].refcount = 0;
653         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
654         
655         return ret;
656 }
657 EXPORT_SYMBOL(tty_register_ldisc);
658
659 /**
660  *      tty_unregister_ldisc    -       unload a line discipline
661  *      @disc: ldisc number
662  *      @new_ldisc: pointer to the ldisc object
663  *
664  *      Remove a line discipline from the kernel providing it is not
665  *      currently in use.
666  *
667  *      Locking:
668  *              takes tty_ldisc_lock to guard against ldisc races
669  */
670
671 int tty_unregister_ldisc(int disc)
672 {
673         unsigned long flags;
674         int ret = 0;
675
676         if (disc < N_TTY || disc >= NR_LDISCS)
677                 return -EINVAL;
678
679         spin_lock_irqsave(&tty_ldisc_lock, flags);
680         if (tty_ldiscs[disc].refcount)
681                 ret = -EBUSY;
682         else
683                 tty_ldiscs[disc].flags &= ~LDISC_FLAG_DEFINED;
684         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
685
686         return ret;
687 }
688 EXPORT_SYMBOL(tty_unregister_ldisc);
689
690 /**
691  *      tty_ldisc_get           -       take a reference to an ldisc
692  *      @disc: ldisc number
693  *
694  *      Takes a reference to a line discipline. Deals with refcounts and
695  *      module locking counts. Returns NULL if the discipline is not available.
696  *      Returns a pointer to the discipline and bumps the ref count if it is
697  *      available
698  *
699  *      Locking:
700  *              takes tty_ldisc_lock to guard against ldisc races
701  */
702
703 struct tty_ldisc *tty_ldisc_get(int disc)
704 {
705         unsigned long flags;
706         struct tty_ldisc *ld;
707
708         if (disc < N_TTY || disc >= NR_LDISCS)
709                 return NULL;
710         
711         spin_lock_irqsave(&tty_ldisc_lock, flags);
712
713         ld = &tty_ldiscs[disc];
714         /* Check the entry is defined */
715         if(ld->flags & LDISC_FLAG_DEFINED)
716         {
717                 /* If the module is being unloaded we can't use it */
718                 if (!try_module_get(ld->owner))
719                         ld = NULL;
720                 else /* lock it */
721                         ld->refcount++;
722         }
723         else
724                 ld = NULL;
725         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
726         return ld;
727 }
728
729 EXPORT_SYMBOL_GPL(tty_ldisc_get);
730
731 /**
732  *      tty_ldisc_put           -       drop ldisc reference
733  *      @disc: ldisc number
734  *
735  *      Drop a reference to a line discipline. Manage refcounts and
736  *      module usage counts
737  *
738  *      Locking:
739  *              takes tty_ldisc_lock to guard against ldisc races
740  */
741
742 void tty_ldisc_put(int disc)
743 {
744         struct tty_ldisc *ld;
745         unsigned long flags;
746         
747         BUG_ON(disc < N_TTY || disc >= NR_LDISCS);
748                 
749         spin_lock_irqsave(&tty_ldisc_lock, flags);
750         ld = &tty_ldiscs[disc];
751         BUG_ON(ld->refcount == 0);
752         ld->refcount--;
753         module_put(ld->owner);
754         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
755 }
756         
757 EXPORT_SYMBOL_GPL(tty_ldisc_put);
758
759 /**
760  *      tty_ldisc_assign        -       set ldisc on a tty
761  *      @tty: tty to assign
762  *      @ld: line discipline
763  *
764  *      Install an instance of a line discipline into a tty structure. The
765  *      ldisc must have a reference count above zero to ensure it remains/
766  *      The tty instance refcount starts at zero.
767  *
768  *      Locking:
769  *              Caller must hold references
770  */
771
772 static void tty_ldisc_assign(struct tty_struct *tty, struct tty_ldisc *ld)
773 {
774         tty->ldisc = *ld;
775         tty->ldisc.refcount = 0;
776 }
777
778 /**
779  *      tty_ldisc_try           -       internal helper
780  *      @tty: the tty
781  *
782  *      Make a single attempt to grab and bump the refcount on
783  *      the tty ldisc. Return 0 on failure or 1 on success. This is
784  *      used to implement both the waiting and non waiting versions
785  *      of tty_ldisc_ref
786  *
787  *      Locking: takes tty_ldisc_lock
788  */
789
790 static int tty_ldisc_try(struct tty_struct *tty)
791 {
792         unsigned long flags;
793         struct tty_ldisc *ld;
794         int ret = 0;
795         
796         spin_lock_irqsave(&tty_ldisc_lock, flags);
797         ld = &tty->ldisc;
798         if(test_bit(TTY_LDISC, &tty->flags))
799         {
800                 ld->refcount++;
801                 ret = 1;
802         }
803         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
804         return ret;
805 }
806
807 /**
808  *      tty_ldisc_ref_wait      -       wait for the tty ldisc
809  *      @tty: tty device
810  *
811  *      Dereference the line discipline for the terminal and take a 
812  *      reference to it. If the line discipline is in flux then 
813  *      wait patiently until it changes.
814  *
815  *      Note: Must not be called from an IRQ/timer context. The caller
816  *      must also be careful not to hold other locks that will deadlock
817  *      against a discipline change, such as an existing ldisc reference
818  *      (which we check for)
819  *
820  *      Locking: call functions take tty_ldisc_lock
821  */
822  
823 struct tty_ldisc *tty_ldisc_ref_wait(struct tty_struct *tty)
824 {
825         /* wait_event is a macro */
826         wait_event(tty_ldisc_wait, tty_ldisc_try(tty));
827         if(tty->ldisc.refcount == 0)
828                 printk(KERN_ERR "tty_ldisc_ref_wait\n");
829         return &tty->ldisc;
830 }
831
832 EXPORT_SYMBOL_GPL(tty_ldisc_ref_wait);
833
834 /**
835  *      tty_ldisc_ref           -       get the tty ldisc
836  *      @tty: tty device
837  *
838  *      Dereference the line discipline for the terminal and take a 
839  *      reference to it. If the line discipline is in flux then 
840  *      return NULL. Can be called from IRQ and timer functions.
841  *
842  *      Locking: called functions take tty_ldisc_lock
843  */
844  
845 struct tty_ldisc *tty_ldisc_ref(struct tty_struct *tty)
846 {
847         if(tty_ldisc_try(tty))
848                 return &tty->ldisc;
849         return NULL;
850 }
851
852 EXPORT_SYMBOL_GPL(tty_ldisc_ref);
853
854 /**
855  *      tty_ldisc_deref         -       free a tty ldisc reference
856  *      @ld: reference to free up
857  *
858  *      Undoes the effect of tty_ldisc_ref or tty_ldisc_ref_wait. May
859  *      be called in IRQ context.
860  *
861  *      Locking: takes tty_ldisc_lock
862  */
863  
864 void tty_ldisc_deref(struct tty_ldisc *ld)
865 {
866         unsigned long flags;
867
868         BUG_ON(ld == NULL);
869                 
870         spin_lock_irqsave(&tty_ldisc_lock, flags);
871         if(ld->refcount == 0)
872                 printk(KERN_ERR "tty_ldisc_deref: no references.\n");
873         else
874                 ld->refcount--;
875         if(ld->refcount == 0)
876                 wake_up(&tty_ldisc_wait);
877         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
878 }
879
880 EXPORT_SYMBOL_GPL(tty_ldisc_deref);
881
882 /**
883  *      tty_ldisc_enable        -       allow ldisc use
884  *      @tty: terminal to activate ldisc on
885  *
886  *      Set the TTY_LDISC flag when the line discipline can be called
887  *      again. Do neccessary wakeups for existing sleepers.
888  *
889  *      Note: nobody should set this bit except via this function. Clearing
890  *      directly is allowed.
891  */
892
893 static void tty_ldisc_enable(struct tty_struct *tty)
894 {
895         set_bit(TTY_LDISC, &tty->flags);
896         wake_up(&tty_ldisc_wait);
897 }
898         
899 /**
900  *      tty_set_ldisc           -       set line discipline
901  *      @tty: the terminal to set
902  *      @ldisc: the line discipline
903  *
904  *      Set the discipline of a tty line. Must be called from a process
905  *      context.
906  *
907  *      Locking: takes tty_ldisc_lock.
908  *               called functions take termios_mutex
909  */
910  
911 static int tty_set_ldisc(struct tty_struct *tty, int ldisc)
912 {
913         int retval = 0;
914         struct tty_ldisc o_ldisc;
915         char buf[64];
916         int work;
917         unsigned long flags;
918         struct tty_ldisc *ld;
919         struct tty_struct *o_tty;
920
921         if ((ldisc < N_TTY) || (ldisc >= NR_LDISCS))
922                 return -EINVAL;
923
924 restart:
925
926         ld = tty_ldisc_get(ldisc);
927         /* Eduardo Blanco <ejbs@cs.cs.com.uy> */
928         /* Cyrus Durgin <cider@speakeasy.org> */
929         if (ld == NULL) {
930                 request_module("tty-ldisc-%d", ldisc);
931                 ld = tty_ldisc_get(ldisc);
932         }
933         if (ld == NULL)
934                 return -EINVAL;
935
936         /*
937          *      No more input please, we are switching. The new ldisc
938          *      will update this value in the ldisc open function
939          */
940
941         tty->receive_room = 0;
942
943         /*
944          *      Problem: What do we do if this blocks ?
945          */
946
947         tty_wait_until_sent(tty, 0);
948
949         if (tty->ldisc.num == ldisc) {
950                 tty_ldisc_put(ldisc);
951                 return 0;
952         }
953
954         o_ldisc = tty->ldisc;
955         o_tty = tty->link;
956
957         /*
958          *      Make sure we don't change while someone holds a
959          *      reference to the line discipline. The TTY_LDISC bit
960          *      prevents anyone taking a reference once it is clear.
961          *      We need the lock to avoid racing reference takers.
962          */
963
964         spin_lock_irqsave(&tty_ldisc_lock, flags);
965         if (tty->ldisc.refcount || (o_tty && o_tty->ldisc.refcount)) {
966                 if(tty->ldisc.refcount) {
967                         /* Free the new ldisc we grabbed. Must drop the lock
968                            first. */
969                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
970                         tty_ldisc_put(ldisc);
971                         /*
972                          * There are several reasons we may be busy, including
973                          * random momentary I/O traffic. We must therefore
974                          * retry. We could distinguish between blocking ops
975                          * and retries if we made tty_ldisc_wait() smarter. That
976                          * is up for discussion.
977                          */
978                         if (wait_event_interruptible(tty_ldisc_wait, tty->ldisc.refcount == 0) < 0)
979                                 return -ERESTARTSYS;
980                         goto restart;
981                 }
982                 if(o_tty && o_tty->ldisc.refcount) {
983                         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
984                         tty_ldisc_put(ldisc);
985                         if (wait_event_interruptible(tty_ldisc_wait, o_tty->ldisc.refcount == 0) < 0)
986                                 return -ERESTARTSYS;
987                         goto restart;
988                 }
989         }
990
991         /* if the TTY_LDISC bit is set, then we are racing against another ldisc change */
992
993         if (!test_bit(TTY_LDISC, &tty->flags)) {
994                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
995                 tty_ldisc_put(ldisc);
996                 ld = tty_ldisc_ref_wait(tty);
997                 tty_ldisc_deref(ld);
998                 goto restart;
999         }
1000
1001         clear_bit(TTY_LDISC, &tty->flags);
1002         if (o_tty)
1003                 clear_bit(TTY_LDISC, &o_tty->flags);
1004         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
1005
1006         /*
1007          *      From this point on we know nobody has an ldisc
1008          *      usage reference, nor can they obtain one until
1009          *      we say so later on.
1010          */
1011
1012         work = cancel_delayed_work(&tty->buf.work);
1013         /*
1014          * Wait for ->hangup_work and ->buf.work handlers to terminate
1015          */
1016          
1017         flush_scheduled_work();
1018         /* Shutdown the current discipline. */
1019         if (tty->ldisc.close)
1020                 (tty->ldisc.close)(tty);
1021
1022         /* Now set up the new line discipline. */
1023         tty_ldisc_assign(tty, ld);
1024         tty_set_termios_ldisc(tty, ldisc);
1025         if (tty->ldisc.open)
1026                 retval = (tty->ldisc.open)(tty);
1027         if (retval < 0) {
1028                 tty_ldisc_put(ldisc);
1029                 /* There is an outstanding reference here so this is safe */
1030                 tty_ldisc_assign(tty, tty_ldisc_get(o_ldisc.num));
1031                 tty_set_termios_ldisc(tty, tty->ldisc.num);
1032                 if (tty->ldisc.open && (tty->ldisc.open(tty) < 0)) {
1033                         tty_ldisc_put(o_ldisc.num);
1034                         /* This driver is always present */
1035                         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
1036                         tty_set_termios_ldisc(tty, N_TTY);
1037                         if (tty->ldisc.open) {
1038                                 int r = tty->ldisc.open(tty);
1039
1040                                 if (r < 0)
1041                                         panic("Couldn't open N_TTY ldisc for "
1042                                               "%s --- error %d.",
1043                                               tty_name(tty, buf), r);
1044                         }
1045                 }
1046         }
1047         /* At this point we hold a reference to the new ldisc and a
1048            a reference to the old ldisc. If we ended up flipping back
1049            to the existing ldisc we have two references to it */
1050         
1051         if (tty->ldisc.num != o_ldisc.num && tty->driver->set_ldisc)
1052                 tty->driver->set_ldisc(tty);
1053                 
1054         tty_ldisc_put(o_ldisc.num);
1055         
1056         /*
1057          *      Allow ldisc referencing to occur as soon as the driver
1058          *      ldisc callback completes.
1059          */
1060          
1061         tty_ldisc_enable(tty);
1062         if (o_tty)
1063                 tty_ldisc_enable(o_tty);
1064         
1065         /* Restart it in case no characters kick it off. Safe if
1066            already running */
1067         if (work)
1068                 schedule_delayed_work(&tty->buf.work, 1);
1069         return retval;
1070 }
1071
1072 /**
1073  *      get_tty_driver          -       find device of a tty
1074  *      @dev_t: device identifier
1075  *      @index: returns the index of the tty
1076  *
1077  *      This routine returns a tty driver structure, given a device number
1078  *      and also passes back the index number.
1079  *
1080  *      Locking: caller must hold tty_mutex
1081  */
1082
1083 static struct tty_driver *get_tty_driver(dev_t device, int *index)
1084 {
1085         struct tty_driver *p;
1086
1087         list_for_each_entry(p, &tty_drivers, tty_drivers) {
1088                 dev_t base = MKDEV(p->major, p->minor_start);
1089                 if (device < base || device >= base + p->num)
1090                         continue;
1091                 *index = device - base;
1092                 return p;
1093         }
1094         return NULL;
1095 }
1096
1097 /**
1098  *      tty_check_change        -       check for POSIX terminal changes
1099  *      @tty: tty to check
1100  *
1101  *      If we try to write to, or set the state of, a terminal and we're
1102  *      not in the foreground, send a SIGTTOU.  If the signal is blocked or
1103  *      ignored, go ahead and perform the operation.  (POSIX 7.2)
1104  *
1105  *      Locking: none
1106  */
1107
1108 int tty_check_change(struct tty_struct * tty)
1109 {
1110         if (current->signal->tty != tty)
1111                 return 0;
1112         if (tty->pgrp <= 0) {
1113                 printk(KERN_WARNING "tty_check_change: tty->pgrp <= 0!\n");
1114                 return 0;
1115         }
1116         if (process_group(current) == tty->pgrp)
1117                 return 0;
1118         if (is_ignored(SIGTTOU))
1119                 return 0;
1120         if (is_orphaned_pgrp(process_group(current)))
1121                 return -EIO;
1122         (void) kill_pg(process_group(current), SIGTTOU, 1);
1123         return -ERESTARTSYS;
1124 }
1125
1126 EXPORT_SYMBOL(tty_check_change);
1127
1128 static ssize_t hung_up_tty_read(struct file * file, char __user * buf,
1129                                 size_t count, loff_t *ppos)
1130 {
1131         return 0;
1132 }
1133
1134 static ssize_t hung_up_tty_write(struct file * file, const char __user * buf,
1135                                  size_t count, loff_t *ppos)
1136 {
1137         return -EIO;
1138 }
1139
1140 /* No kernel lock held - none needed ;) */
1141 static unsigned int hung_up_tty_poll(struct file * filp, poll_table * wait)
1142 {
1143         return POLLIN | POLLOUT | POLLERR | POLLHUP | POLLRDNORM | POLLWRNORM;
1144 }
1145
1146 static int hung_up_tty_ioctl(struct inode * inode, struct file * file,
1147                              unsigned int cmd, unsigned long arg)
1148 {
1149         return cmd == TIOCSPGRP ? -ENOTTY : -EIO;
1150 }
1151
1152 static const struct file_operations tty_fops = {
1153         .llseek         = no_llseek,
1154         .read           = tty_read,
1155         .write          = tty_write,
1156         .poll           = tty_poll,
1157         .ioctl          = tty_ioctl,
1158         .open           = tty_open,
1159         .release        = tty_release,
1160         .fasync         = tty_fasync,
1161 };
1162
1163 #ifdef CONFIG_UNIX98_PTYS
1164 static const struct file_operations ptmx_fops = {
1165         .llseek         = no_llseek,
1166         .read           = tty_read,
1167         .write          = tty_write,
1168         .poll           = tty_poll,
1169         .ioctl          = tty_ioctl,
1170         .open           = ptmx_open,
1171         .release        = tty_release,
1172         .fasync         = tty_fasync,
1173 };
1174 #endif
1175
1176 static const struct file_operations console_fops = {
1177         .llseek         = no_llseek,
1178         .read           = tty_read,
1179         .write          = redirected_tty_write,
1180         .poll           = tty_poll,
1181         .ioctl          = tty_ioctl,
1182         .open           = tty_open,
1183         .release        = tty_release,
1184         .fasync         = tty_fasync,
1185 };
1186
1187 static const struct file_operations hung_up_tty_fops = {
1188         .llseek         = no_llseek,
1189         .read           = hung_up_tty_read,
1190         .write          = hung_up_tty_write,
1191         .poll           = hung_up_tty_poll,
1192         .ioctl          = hung_up_tty_ioctl,
1193         .release        = tty_release,
1194 };
1195
1196 static DEFINE_SPINLOCK(redirect_lock);
1197 static struct file *redirect;
1198
1199 /**
1200  *      tty_wakeup      -       request more data
1201  *      @tty: terminal
1202  *
1203  *      Internal and external helper for wakeups of tty. This function
1204  *      informs the line discipline if present that the driver is ready
1205  *      to receive more output data.
1206  */
1207  
1208 void tty_wakeup(struct tty_struct *tty)
1209 {
1210         struct tty_ldisc *ld;
1211         
1212         if (test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) {
1213                 ld = tty_ldisc_ref(tty);
1214                 if(ld) {
1215                         if(ld->write_wakeup)
1216                                 ld->write_wakeup(tty);
1217                         tty_ldisc_deref(ld);
1218                 }
1219         }
1220         wake_up_interruptible(&tty->write_wait);
1221 }
1222
1223 EXPORT_SYMBOL_GPL(tty_wakeup);
1224
1225 /**
1226  *      tty_ldisc_flush -       flush line discipline queue
1227  *      @tty: tty
1228  *
1229  *      Flush the line discipline queue (if any) for this tty. If there
1230  *      is no line discipline active this is a no-op.
1231  */
1232  
1233 void tty_ldisc_flush(struct tty_struct *tty)
1234 {
1235         struct tty_ldisc *ld = tty_ldisc_ref(tty);
1236         if(ld) {
1237                 if(ld->flush_buffer)
1238                         ld->flush_buffer(tty);
1239                 tty_ldisc_deref(ld);
1240         }
1241 }
1242
1243 EXPORT_SYMBOL_GPL(tty_ldisc_flush);
1244
1245 /**
1246  *      tty_reset_termios       -       reset terminal state
1247  *      @tty: tty to reset
1248  *
1249  *      Restore a terminal to the driver default state
1250  */
1251
1252 static void tty_reset_termios(struct tty_struct *tty)
1253 {
1254         mutex_lock(&tty->termios_mutex);
1255         *tty->termios = tty->driver->init_termios;
1256         tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
1257         tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
1258         mutex_unlock(&tty->termios_mutex);
1259 }
1260         
1261 /**
1262  *      do_tty_hangup           -       actual handler for hangup events
1263  *      @work: tty device
1264  *
1265  *      This can be called by the "eventd" kernel thread.  That is process
1266  *      synchronous but doesn't hold any locks, so we need to make sure we
1267  *      have the appropriate locks for what we're doing.
1268  *
1269  *      The hangup event clears any pending redirections onto the hung up
1270  *      device. It ensures future writes will error and it does the needed
1271  *      line discipline hangup and signal delivery. The tty object itself
1272  *      remains intact.
1273  *
1274  *      Locking:
1275  *              BKL
1276  *                redirect lock for undoing redirection
1277  *                file list lock for manipulating list of ttys
1278  *                tty_ldisc_lock from called functions
1279  *                termios_mutex resetting termios data
1280  *                tasklist_lock to walk task list for hangup event
1281  *                  ->siglock to protect ->signal/->sighand
1282  */
1283 static void do_tty_hangup(struct work_struct *work)
1284 {
1285         struct tty_struct *tty =
1286                 container_of(work, struct tty_struct, hangup_work);
1287         struct file * cons_filp = NULL;
1288         struct file *filp, *f = NULL;
1289         struct task_struct *p;
1290         struct tty_ldisc *ld;
1291         int    closecount = 0, n;
1292
1293         if (!tty)
1294                 return;
1295
1296         /* inuse_filps is protected by the single kernel lock */
1297         lock_kernel();
1298
1299         spin_lock(&redirect_lock);
1300         if (redirect && redirect->private_data == tty) {
1301                 f = redirect;
1302                 redirect = NULL;
1303         }
1304         spin_unlock(&redirect_lock);
1305         
1306         check_tty_count(tty, "do_tty_hangup");
1307         file_list_lock();
1308         /* This breaks for file handles being sent over AF_UNIX sockets ? */
1309         list_for_each_entry(filp, &tty->tty_files, f_u.fu_list) {
1310                 if (filp->f_op->write == redirected_tty_write)
1311                         cons_filp = filp;
1312                 if (filp->f_op->write != tty_write)
1313                         continue;
1314                 closecount++;
1315                 tty_fasync(-1, filp, 0);        /* can't block */
1316                 filp->f_op = &hung_up_tty_fops;
1317         }
1318         file_list_unlock();
1319         
1320         /* FIXME! What are the locking issues here? This may me overdoing things..
1321          * this question is especially important now that we've removed the irqlock. */
1322
1323         ld = tty_ldisc_ref(tty);
1324         if(ld != NULL)  /* We may have no line discipline at this point */
1325         {
1326                 if (ld->flush_buffer)
1327                         ld->flush_buffer(tty);
1328                 if (tty->driver->flush_buffer)
1329                         tty->driver->flush_buffer(tty);
1330                 if ((test_bit(TTY_DO_WRITE_WAKEUP, &tty->flags)) &&
1331                     ld->write_wakeup)
1332                         ld->write_wakeup(tty);
1333                 if (ld->hangup)
1334                         ld->hangup(tty);
1335         }
1336
1337         /* FIXME: Once we trust the LDISC code better we can wait here for
1338            ldisc completion and fix the driver call race */
1339            
1340         wake_up_interruptible(&tty->write_wait);
1341         wake_up_interruptible(&tty->read_wait);
1342
1343         /*
1344          * Shutdown the current line discipline, and reset it to
1345          * N_TTY.
1346          */
1347         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS)
1348                 tty_reset_termios(tty);
1349         
1350         /* Defer ldisc switch */
1351         /* tty_deferred_ldisc_switch(N_TTY);
1352         
1353           This should get done automatically when the port closes and
1354           tty_release is called */
1355         
1356         read_lock(&tasklist_lock);
1357         if (tty->session > 0) {
1358                 do_each_task_pid(tty->session, PIDTYPE_SID, p) {
1359                         spin_lock_irq(&p->sighand->siglock);
1360                         if (p->signal->tty == tty)
1361                                 p->signal->tty = NULL;
1362                         if (!p->signal->leader) {
1363                                 spin_unlock_irq(&p->sighand->siglock);
1364                                 continue;
1365                         }
1366                         __group_send_sig_info(SIGHUP, SEND_SIG_PRIV, p);
1367                         __group_send_sig_info(SIGCONT, SEND_SIG_PRIV, p);
1368                         if (tty->pgrp > 0)
1369                                 p->signal->tty_old_pgrp = tty->pgrp;
1370                         spin_unlock_irq(&p->sighand->siglock);
1371                 } while_each_task_pid(tty->session, PIDTYPE_SID, p);
1372         }
1373         read_unlock(&tasklist_lock);
1374
1375         tty->flags = 0;
1376         tty->session = 0;
1377         tty->pgrp = -1;
1378         tty->ctrl_status = 0;
1379         /*
1380          *      If one of the devices matches a console pointer, we
1381          *      cannot just call hangup() because that will cause
1382          *      tty->count and state->count to go out of sync.
1383          *      So we just call close() the right number of times.
1384          */
1385         if (cons_filp) {
1386                 if (tty->driver->close)
1387                         for (n = 0; n < closecount; n++)
1388                                 tty->driver->close(tty, cons_filp);
1389         } else if (tty->driver->hangup)
1390                 (tty->driver->hangup)(tty);
1391                 
1392         /* We don't want to have driver/ldisc interactions beyond
1393            the ones we did here. The driver layer expects no
1394            calls after ->hangup() from the ldisc side. However we
1395            can't yet guarantee all that */
1396
1397         set_bit(TTY_HUPPED, &tty->flags);
1398         if (ld) {
1399                 tty_ldisc_enable(tty);
1400                 tty_ldisc_deref(ld);
1401         }
1402         unlock_kernel();
1403         if (f)
1404                 fput(f);
1405 }
1406
1407 /**
1408  *      tty_hangup              -       trigger a hangup event
1409  *      @tty: tty to hangup
1410  *
1411  *      A carrier loss (virtual or otherwise) has occurred on this like
1412  *      schedule a hangup sequence to run after this event.
1413  */
1414
1415 void tty_hangup(struct tty_struct * tty)
1416 {
1417 #ifdef TTY_DEBUG_HANGUP
1418         char    buf[64];
1419         
1420         printk(KERN_DEBUG "%s hangup...\n", tty_name(tty, buf));
1421 #endif
1422         schedule_work(&tty->hangup_work);
1423 }
1424
1425 EXPORT_SYMBOL(tty_hangup);
1426
1427 /**
1428  *      tty_vhangup             -       process vhangup
1429  *      @tty: tty to hangup
1430  *
1431  *      The user has asked via system call for the terminal to be hung up.
1432  *      We do this synchronously so that when the syscall returns the process
1433  *      is complete. That guarantee is neccessary for security reasons.
1434  */
1435
1436 void tty_vhangup(struct tty_struct * tty)
1437 {
1438 #ifdef TTY_DEBUG_HANGUP
1439         char    buf[64];
1440
1441         printk(KERN_DEBUG "%s vhangup...\n", tty_name(tty, buf));
1442 #endif
1443         do_tty_hangup(&tty->hangup_work);
1444 }
1445 EXPORT_SYMBOL(tty_vhangup);
1446
1447 /**
1448  *      tty_hung_up_p           -       was tty hung up
1449  *      @filp: file pointer of tty
1450  *
1451  *      Return true if the tty has been subject to a vhangup or a carrier
1452  *      loss
1453  */
1454
1455 int tty_hung_up_p(struct file * filp)
1456 {
1457         return (filp->f_op == &hung_up_tty_fops);
1458 }
1459
1460 EXPORT_SYMBOL(tty_hung_up_p);
1461
1462 static void session_clear_tty(pid_t session)
1463 {
1464         struct task_struct *p;
1465         do_each_task_pid(session, PIDTYPE_SID, p) {
1466                 proc_clear_tty(p);
1467         } while_each_task_pid(session, PIDTYPE_SID, p);
1468 }
1469
1470 /**
1471  *      disassociate_ctty       -       disconnect controlling tty
1472  *      @on_exit: true if exiting so need to "hang up" the session
1473  *
1474  *      This function is typically called only by the session leader, when
1475  *      it wants to disassociate itself from its controlling tty.
1476  *
1477  *      It performs the following functions:
1478  *      (1)  Sends a SIGHUP and SIGCONT to the foreground process group
1479  *      (2)  Clears the tty from being controlling the session
1480  *      (3)  Clears the controlling tty for all processes in the
1481  *              session group.
1482  *
1483  *      The argument on_exit is set to 1 if called when a process is
1484  *      exiting; it is 0 if called by the ioctl TIOCNOTTY.
1485  *
1486  *      Locking:
1487  *              BKL is taken for hysterical raisins
1488  *                tty_mutex is taken to protect tty
1489  *                ->siglock is taken to protect ->signal/->sighand
1490  *                tasklist_lock is taken to walk process list for sessions
1491  *                  ->siglock is taken to protect ->signal/->sighand
1492  */
1493
1494 void disassociate_ctty(int on_exit)
1495 {
1496         struct tty_struct *tty;
1497         int tty_pgrp = -1;
1498         int session;
1499
1500         lock_kernel();
1501
1502         mutex_lock(&tty_mutex);
1503         tty = get_current_tty();
1504         if (tty) {
1505                 tty_pgrp = tty->pgrp;
1506                 mutex_unlock(&tty_mutex);
1507                 /* XXX: here we race, there is nothing protecting tty */
1508                 if (on_exit && tty->driver->type != TTY_DRIVER_TYPE_PTY)
1509                         tty_vhangup(tty);
1510         } else {
1511                 pid_t old_pgrp = current->signal->tty_old_pgrp;
1512                 if (old_pgrp) {
1513                         kill_pg(old_pgrp, SIGHUP, on_exit);
1514                         kill_pg(old_pgrp, SIGCONT, on_exit);
1515                 }
1516                 mutex_unlock(&tty_mutex);
1517                 unlock_kernel();        
1518                 return;
1519         }
1520         if (tty_pgrp > 0) {
1521                 kill_pg(tty_pgrp, SIGHUP, on_exit);
1522                 if (!on_exit)
1523                         kill_pg(tty_pgrp, SIGCONT, on_exit);
1524         }
1525
1526         spin_lock_irq(&current->sighand->siglock);
1527         current->signal->tty_old_pgrp = 0;
1528         session = process_session(current);
1529         spin_unlock_irq(&current->sighand->siglock);
1530
1531         mutex_lock(&tty_mutex);
1532         /* It is possible that do_tty_hangup has free'd this tty */
1533         tty = get_current_tty();
1534         if (tty) {
1535                 tty->session = 0;
1536                 tty->pgrp = 0;
1537         } else {
1538 #ifdef TTY_DEBUG_HANGUP
1539                 printk(KERN_DEBUG "error attempted to write to tty [0x%p]"
1540                        " = NULL", tty);
1541 #endif
1542         }
1543         mutex_unlock(&tty_mutex);
1544
1545         /* Now clear signal->tty under the lock */
1546         read_lock(&tasklist_lock);
1547         session_clear_tty(session);
1548         read_unlock(&tasklist_lock);
1549         unlock_kernel();
1550 }
1551
1552
1553 /**
1554  *      stop_tty        -       propogate flow control
1555  *      @tty: tty to stop
1556  *
1557  *      Perform flow control to the driver. For PTY/TTY pairs we
1558  *      must also propogate the TIOCKPKT status. May be called
1559  *      on an already stopped device and will not re-call the driver
1560  *      method.
1561  *
1562  *      This functionality is used by both the line disciplines for
1563  *      halting incoming flow and by the driver. It may therefore be
1564  *      called from any context, may be under the tty atomic_write_lock
1565  *      but not always.
1566  *
1567  *      Locking:
1568  *              Broken. Relies on BKL which is unsafe here.
1569  */
1570
1571 void stop_tty(struct tty_struct *tty)
1572 {
1573         if (tty->stopped)
1574                 return;
1575         tty->stopped = 1;
1576         if (tty->link && tty->link->packet) {
1577                 tty->ctrl_status &= ~TIOCPKT_START;
1578                 tty->ctrl_status |= TIOCPKT_STOP;
1579                 wake_up_interruptible(&tty->link->read_wait);
1580         }
1581         if (tty->driver->stop)
1582                 (tty->driver->stop)(tty);
1583 }
1584
1585 EXPORT_SYMBOL(stop_tty);
1586
1587 /**
1588  *      start_tty       -       propogate flow control
1589  *      @tty: tty to start
1590  *
1591  *      Start a tty that has been stopped if at all possible. Perform
1592  *      any neccessary wakeups and propogate the TIOCPKT status. If this
1593  *      is the tty was previous stopped and is being started then the
1594  *      driver start method is invoked and the line discipline woken.
1595  *
1596  *      Locking:
1597  *              Broken. Relies on BKL which is unsafe here.
1598  */
1599
1600 void start_tty(struct tty_struct *tty)
1601 {
1602         if (!tty->stopped || tty->flow_stopped)
1603                 return;
1604         tty->stopped = 0;
1605         if (tty->link && tty->link->packet) {
1606                 tty->ctrl_status &= ~TIOCPKT_STOP;
1607                 tty->ctrl_status |= TIOCPKT_START;
1608                 wake_up_interruptible(&tty->link->read_wait);
1609         }
1610         if (tty->driver->start)
1611                 (tty->driver->start)(tty);
1612
1613         /* If we have a running line discipline it may need kicking */
1614         tty_wakeup(tty);
1615         wake_up_interruptible(&tty->write_wait);
1616 }
1617
1618 EXPORT_SYMBOL(start_tty);
1619
1620 /**
1621  *      tty_read        -       read method for tty device files
1622  *      @file: pointer to tty file
1623  *      @buf: user buffer
1624  *      @count: size of user buffer
1625  *      @ppos: unused
1626  *
1627  *      Perform the read system call function on this terminal device. Checks
1628  *      for hung up devices before calling the line discipline method.
1629  *
1630  *      Locking:
1631  *              Locks the line discipline internally while needed
1632  *              For historical reasons the line discipline read method is
1633  *      invoked under the BKL. This will go away in time so do not rely on it
1634  *      in new code. Multiple read calls may be outstanding in parallel.
1635  */
1636
1637 static ssize_t tty_read(struct file * file, char __user * buf, size_t count, 
1638                         loff_t *ppos)
1639 {
1640         int i;
1641         struct tty_struct * tty;
1642         struct inode *inode;
1643         struct tty_ldisc *ld;
1644
1645         tty = (struct tty_struct *)file->private_data;
1646         inode = file->f_path.dentry->d_inode;
1647         if (tty_paranoia_check(tty, inode, "tty_read"))
1648                 return -EIO;
1649         if (!tty || (test_bit(TTY_IO_ERROR, &tty->flags)))
1650                 return -EIO;
1651
1652         /* We want to wait for the line discipline to sort out in this
1653            situation */
1654         ld = tty_ldisc_ref_wait(tty);
1655         lock_kernel();
1656         if (ld->read)
1657                 i = (ld->read)(tty,file,buf,count);
1658         else
1659                 i = -EIO;
1660         tty_ldisc_deref(ld);
1661         unlock_kernel();
1662         if (i > 0)
1663                 inode->i_atime = current_fs_time(inode->i_sb);
1664         return i;
1665 }
1666
1667 /*
1668  * Split writes up in sane blocksizes to avoid
1669  * denial-of-service type attacks
1670  */
1671 static inline ssize_t do_tty_write(
1672         ssize_t (*write)(struct tty_struct *, struct file *, const unsigned char *, size_t),
1673         struct tty_struct *tty,
1674         struct file *file,
1675         const char __user *buf,
1676         size_t count)
1677 {
1678         ssize_t ret = 0, written = 0;
1679         unsigned int chunk;
1680         
1681         /* FIXME: O_NDELAY ... */
1682         if (mutex_lock_interruptible(&tty->atomic_write_lock)) {
1683                 return -ERESTARTSYS;
1684         }
1685
1686         /*
1687          * We chunk up writes into a temporary buffer. This
1688          * simplifies low-level drivers immensely, since they
1689          * don't have locking issues and user mode accesses.
1690          *
1691          * But if TTY_NO_WRITE_SPLIT is set, we should use a
1692          * big chunk-size..
1693          *
1694          * The default chunk-size is 2kB, because the NTTY
1695          * layer has problems with bigger chunks. It will
1696          * claim to be able to handle more characters than
1697          * it actually does.
1698          *
1699          * FIXME: This can probably go away now except that 64K chunks
1700          * are too likely to fail unless switched to vmalloc...
1701          */
1702         chunk = 2048;
1703         if (test_bit(TTY_NO_WRITE_SPLIT, &tty->flags))
1704                 chunk = 65536;
1705         if (count < chunk)
1706                 chunk = count;
1707
1708         /* write_buf/write_cnt is protected by the atomic_write_lock mutex */
1709         if (tty->write_cnt < chunk) {
1710                 unsigned char *buf;
1711
1712                 if (chunk < 1024)
1713                         chunk = 1024;
1714
1715                 buf = kmalloc(chunk, GFP_KERNEL);
1716                 if (!buf) {
1717                         mutex_unlock(&tty->atomic_write_lock);
1718                         return -ENOMEM;
1719                 }
1720                 kfree(tty->write_buf);
1721                 tty->write_cnt = chunk;
1722                 tty->write_buf = buf;
1723         }
1724
1725         /* Do the write .. */
1726         for (;;) {
1727                 size_t size = count;
1728                 if (size > chunk)
1729                         size = chunk;
1730                 ret = -EFAULT;
1731                 if (copy_from_user(tty->write_buf, buf, size))
1732                         break;
1733                 lock_kernel();
1734                 ret = write(tty, file, tty->write_buf, size);
1735                 unlock_kernel();
1736                 if (ret <= 0)
1737                         break;
1738                 written += ret;
1739                 buf += ret;
1740                 count -= ret;
1741                 if (!count)
1742                         break;
1743                 ret = -ERESTARTSYS;
1744                 if (signal_pending(current))
1745                         break;
1746                 cond_resched();
1747         }
1748         if (written) {
1749                 struct inode *inode = file->f_path.dentry->d_inode;
1750                 inode->i_mtime = current_fs_time(inode->i_sb);
1751                 ret = written;
1752         }
1753         mutex_unlock(&tty->atomic_write_lock);
1754         return ret;
1755 }
1756
1757
1758 /**
1759  *      tty_write               -       write method for tty device file
1760  *      @file: tty file pointer
1761  *      @buf: user data to write
1762  *      @count: bytes to write
1763  *      @ppos: unused
1764  *
1765  *      Write data to a tty device via the line discipline.
1766  *
1767  *      Locking:
1768  *              Locks the line discipline as required
1769  *              Writes to the tty driver are serialized by the atomic_write_lock
1770  *      and are then processed in chunks to the device. The line discipline
1771  *      write method will not be involked in parallel for each device
1772  *              The line discipline write method is called under the big
1773  *      kernel lock for historical reasons. New code should not rely on this.
1774  */
1775
1776 static ssize_t tty_write(struct file * file, const char __user * buf, size_t count,
1777                          loff_t *ppos)
1778 {
1779         struct tty_struct * tty;
1780         struct inode *inode = file->f_path.dentry->d_inode;
1781         ssize_t ret;
1782         struct tty_ldisc *ld;
1783         
1784         tty = (struct tty_struct *)file->private_data;
1785         if (tty_paranoia_check(tty, inode, "tty_write"))
1786                 return -EIO;
1787         if (!tty || !tty->driver->write || (test_bit(TTY_IO_ERROR, &tty->flags)))
1788                 return -EIO;
1789
1790         ld = tty_ldisc_ref_wait(tty);           
1791         if (!ld->write)
1792                 ret = -EIO;
1793         else
1794                 ret = do_tty_write(ld->write, tty, file, buf, count);
1795         tty_ldisc_deref(ld);
1796         return ret;
1797 }
1798
1799 ssize_t redirected_tty_write(struct file * file, const char __user * buf, size_t count,
1800                          loff_t *ppos)
1801 {
1802         struct file *p = NULL;
1803
1804         spin_lock(&redirect_lock);
1805         if (redirect) {
1806                 get_file(redirect);
1807                 p = redirect;
1808         }
1809         spin_unlock(&redirect_lock);
1810
1811         if (p) {
1812                 ssize_t res;
1813                 res = vfs_write(p, buf, count, &p->f_pos);
1814                 fput(p);
1815                 return res;
1816         }
1817
1818         return tty_write(file, buf, count, ppos);
1819 }
1820
1821 static char ptychar[] = "pqrstuvwxyzabcde";
1822
1823 /**
1824  *      pty_line_name   -       generate name for a pty
1825  *      @driver: the tty driver in use
1826  *      @index: the minor number
1827  *      @p: output buffer of at least 6 bytes
1828  *
1829  *      Generate a name from a driver reference and write it to the output
1830  *      buffer.
1831  *
1832  *      Locking: None
1833  */
1834 static void pty_line_name(struct tty_driver *driver, int index, char *p)
1835 {
1836         int i = index + driver->name_base;
1837         /* ->name is initialized to "ttyp", but "tty" is expected */
1838         sprintf(p, "%s%c%x",
1839                         driver->subtype == PTY_TYPE_SLAVE ? "tty" : driver->name,
1840                         ptychar[i >> 4 & 0xf], i & 0xf);
1841 }
1842
1843 /**
1844  *      pty_line_name   -       generate name for a tty
1845  *      @driver: the tty driver in use
1846  *      @index: the minor number
1847  *      @p: output buffer of at least 7 bytes
1848  *
1849  *      Generate a name from a driver reference and write it to the output
1850  *      buffer.
1851  *
1852  *      Locking: None
1853  */
1854 static void tty_line_name(struct tty_driver *driver, int index, char *p)
1855 {
1856         sprintf(p, "%s%d", driver->name, index + driver->name_base);
1857 }
1858
1859 /**
1860  *      init_dev                -       initialise a tty device
1861  *      @driver: tty driver we are opening a device on
1862  *      @idx: device index
1863  *      @tty: returned tty structure
1864  *
1865  *      Prepare a tty device. This may not be a "new" clean device but
1866  *      could also be an active device. The pty drivers require special
1867  *      handling because of this.
1868  *
1869  *      Locking:
1870  *              The function is called under the tty_mutex, which
1871  *      protects us from the tty struct or driver itself going away.
1872  *
1873  *      On exit the tty device has the line discipline attached and
1874  *      a reference count of 1. If a pair was created for pty/tty use
1875  *      and the other was a pty master then it too has a reference count of 1.
1876  *
1877  * WSH 06/09/97: Rewritten to remove races and properly clean up after a
1878  * failed open.  The new code protects the open with a mutex, so it's
1879  * really quite straightforward.  The mutex locking can probably be
1880  * relaxed for the (most common) case of reopening a tty.
1881  */
1882
1883 static int init_dev(struct tty_driver *driver, int idx,
1884         struct tty_struct **ret_tty)
1885 {
1886         struct tty_struct *tty, *o_tty;
1887         struct ktermios *tp, **tp_loc, *o_tp, **o_tp_loc;
1888         struct ktermios *ltp, **ltp_loc, *o_ltp, **o_ltp_loc;
1889         int retval = 0;
1890
1891         /* check whether we're reopening an existing tty */
1892         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1893                 tty = devpts_get_tty(idx);
1894                 if (tty && driver->subtype == PTY_TYPE_MASTER)
1895                         tty = tty->link;
1896         } else {
1897                 tty = driver->ttys[idx];
1898         }
1899         if (tty) goto fast_track;
1900
1901         /*
1902          * First time open is complex, especially for PTY devices.
1903          * This code guarantees that either everything succeeds and the
1904          * TTY is ready for operation, or else the table slots are vacated
1905          * and the allocated memory released.  (Except that the termios 
1906          * and locked termios may be retained.)
1907          */
1908
1909         if (!try_module_get(driver->owner)) {
1910                 retval = -ENODEV;
1911                 goto end_init;
1912         }
1913
1914         o_tty = NULL;
1915         tp = o_tp = NULL;
1916         ltp = o_ltp = NULL;
1917
1918         tty = alloc_tty_struct();
1919         if(!tty)
1920                 goto fail_no_mem;
1921         initialize_tty_struct(tty);
1922         tty->driver = driver;
1923         tty->index = idx;
1924         tty_line_name(driver, idx, tty->name);
1925
1926         if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1927                 tp_loc = &tty->termios;
1928                 ltp_loc = &tty->termios_locked;
1929         } else {
1930                 tp_loc = &driver->termios[idx];
1931                 ltp_loc = &driver->termios_locked[idx];
1932         }
1933
1934         if (!*tp_loc) {
1935                 tp = (struct ktermios *) kmalloc(sizeof(struct ktermios),
1936                                                 GFP_KERNEL);
1937                 if (!tp)
1938                         goto free_mem_out;
1939                 *tp = driver->init_termios;
1940         }
1941
1942         if (!*ltp_loc) {
1943                 ltp = (struct ktermios *) kmalloc(sizeof(struct ktermios),
1944                                                  GFP_KERNEL);
1945                 if (!ltp)
1946                         goto free_mem_out;
1947                 memset(ltp, 0, sizeof(struct ktermios));
1948         }
1949
1950         if (driver->type == TTY_DRIVER_TYPE_PTY) {
1951                 o_tty = alloc_tty_struct();
1952                 if (!o_tty)
1953                         goto free_mem_out;
1954                 initialize_tty_struct(o_tty);
1955                 o_tty->driver = driver->other;
1956                 o_tty->index = idx;
1957                 tty_line_name(driver->other, idx, o_tty->name);
1958
1959                 if (driver->flags & TTY_DRIVER_DEVPTS_MEM) {
1960                         o_tp_loc = &o_tty->termios;
1961                         o_ltp_loc = &o_tty->termios_locked;
1962                 } else {
1963                         o_tp_loc = &driver->other->termios[idx];
1964                         o_ltp_loc = &driver->other->termios_locked[idx];
1965                 }
1966
1967                 if (!*o_tp_loc) {
1968                         o_tp = (struct ktermios *)
1969                                 kmalloc(sizeof(struct ktermios), GFP_KERNEL);
1970                         if (!o_tp)
1971                                 goto free_mem_out;
1972                         *o_tp = driver->other->init_termios;
1973                 }
1974
1975                 if (!*o_ltp_loc) {
1976                         o_ltp = (struct ktermios *)
1977                                 kmalloc(sizeof(struct ktermios), GFP_KERNEL);
1978                         if (!o_ltp)
1979                                 goto free_mem_out;
1980                         memset(o_ltp, 0, sizeof(struct ktermios));
1981                 }
1982
1983                 /*
1984                  * Everything allocated ... set up the o_tty structure.
1985                  */
1986                 if (!(driver->other->flags & TTY_DRIVER_DEVPTS_MEM)) {
1987                         driver->other->ttys[idx] = o_tty;
1988                 }
1989                 if (!*o_tp_loc)
1990                         *o_tp_loc = o_tp;
1991                 if (!*o_ltp_loc)
1992                         *o_ltp_loc = o_ltp;
1993                 o_tty->termios = *o_tp_loc;
1994                 o_tty->termios_locked = *o_ltp_loc;
1995                 driver->other->refcount++;
1996                 if (driver->subtype == PTY_TYPE_MASTER)
1997                         o_tty->count++;
1998
1999                 /* Establish the links in both directions */
2000                 tty->link   = o_tty;
2001                 o_tty->link = tty;
2002         }
2003
2004         /* 
2005          * All structures have been allocated, so now we install them.
2006          * Failures after this point use release_mem to clean up, so 
2007          * there's no need to null out the local pointers.
2008          */
2009         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
2010                 driver->ttys[idx] = tty;
2011         }
2012         
2013         if (!*tp_loc)
2014                 *tp_loc = tp;
2015         if (!*ltp_loc)
2016                 *ltp_loc = ltp;
2017         tty->termios = *tp_loc;
2018         tty->termios_locked = *ltp_loc;
2019         /* Compatibility until drivers always set this */
2020         tty->termios->c_ispeed = tty_termios_input_baud_rate(tty->termios);
2021         tty->termios->c_ospeed = tty_termios_baud_rate(tty->termios);
2022         driver->refcount++;
2023         tty->count++;
2024
2025         /* 
2026          * Structures all installed ... call the ldisc open routines.
2027          * If we fail here just call release_mem to clean up.  No need
2028          * to decrement the use counts, as release_mem doesn't care.
2029          */
2030
2031         if (tty->ldisc.open) {
2032                 retval = (tty->ldisc.open)(tty);
2033                 if (retval)
2034                         goto release_mem_out;
2035         }
2036         if (o_tty && o_tty->ldisc.open) {
2037                 retval = (o_tty->ldisc.open)(o_tty);
2038                 if (retval) {
2039                         if (tty->ldisc.close)
2040                                 (tty->ldisc.close)(tty);
2041                         goto release_mem_out;
2042                 }
2043                 tty_ldisc_enable(o_tty);
2044         }
2045         tty_ldisc_enable(tty);
2046         goto success;
2047
2048         /*
2049          * This fast open can be used if the tty is already open.
2050          * No memory is allocated, and the only failures are from
2051          * attempting to open a closing tty or attempting multiple
2052          * opens on a pty master.
2053          */
2054 fast_track:
2055         if (test_bit(TTY_CLOSING, &tty->flags)) {
2056                 retval = -EIO;
2057                 goto end_init;
2058         }
2059         if (driver->type == TTY_DRIVER_TYPE_PTY &&
2060             driver->subtype == PTY_TYPE_MASTER) {
2061                 /*
2062                  * special case for PTY masters: only one open permitted, 
2063                  * and the slave side open count is incremented as well.
2064                  */
2065                 if (tty->count) {
2066                         retval = -EIO;
2067                         goto end_init;
2068                 }
2069                 tty->link->count++;
2070         }
2071         tty->count++;
2072         tty->driver = driver; /* N.B. why do this every time?? */
2073
2074         /* FIXME */
2075         if(!test_bit(TTY_LDISC, &tty->flags))
2076                 printk(KERN_ERR "init_dev but no ldisc\n");
2077 success:
2078         *ret_tty = tty;
2079         
2080         /* All paths come through here to release the mutex */
2081 end_init:
2082         return retval;
2083
2084         /* Release locally allocated memory ... nothing placed in slots */
2085 free_mem_out:
2086         kfree(o_tp);
2087         if (o_tty)
2088                 free_tty_struct(o_tty);
2089         kfree(ltp);
2090         kfree(tp);
2091         free_tty_struct(tty);
2092
2093 fail_no_mem:
2094         module_put(driver->owner);
2095         retval = -ENOMEM;
2096         goto end_init;
2097
2098         /* call the tty release_mem routine to clean out this slot */
2099 release_mem_out:
2100         if (printk_ratelimit())
2101                 printk(KERN_INFO "init_dev: ldisc open failed, "
2102                                  "clearing slot %d\n", idx);
2103         release_mem(tty, idx);
2104         goto end_init;
2105 }
2106
2107 /**
2108  *      release_mem             -       release tty structure memory
2109  *
2110  *      Releases memory associated with a tty structure, and clears out the
2111  *      driver table slots. This function is called when a device is no longer
2112  *      in use. It also gets called when setup of a device fails.
2113  *
2114  *      Locking:
2115  *              tty_mutex - sometimes only
2116  *              takes the file list lock internally when working on the list
2117  *      of ttys that the driver keeps.
2118  *              FIXME: should we require tty_mutex is held here ??
2119  */
2120
2121 static void release_mem(struct tty_struct *tty, int idx)
2122 {
2123         struct tty_struct *o_tty;
2124         struct ktermios *tp;
2125         int devpts = tty->driver->flags & TTY_DRIVER_DEVPTS_MEM;
2126
2127         if ((o_tty = tty->link) != NULL) {
2128                 if (!devpts)
2129                         o_tty->driver->ttys[idx] = NULL;
2130                 if (o_tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
2131                         tp = o_tty->termios;
2132                         if (!devpts)
2133                                 o_tty->driver->termios[idx] = NULL;
2134                         kfree(tp);
2135
2136                         tp = o_tty->termios_locked;
2137                         if (!devpts)
2138                                 o_tty->driver->termios_locked[idx] = NULL;
2139                         kfree(tp);
2140                 }
2141                 o_tty->magic = 0;
2142                 o_tty->driver->refcount--;
2143                 file_list_lock();
2144                 list_del_init(&o_tty->tty_files);
2145                 file_list_unlock();
2146                 free_tty_struct(o_tty);
2147         }
2148
2149         if (!devpts)
2150                 tty->driver->ttys[idx] = NULL;
2151         if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
2152                 tp = tty->termios;
2153                 if (!devpts)
2154                         tty->driver->termios[idx] = NULL;
2155                 kfree(tp);
2156
2157                 tp = tty->termios_locked;
2158                 if (!devpts)
2159                         tty->driver->termios_locked[idx] = NULL;
2160                 kfree(tp);
2161         }
2162
2163         tty->magic = 0;
2164         tty->driver->refcount--;
2165         file_list_lock();
2166         list_del_init(&tty->tty_files);
2167         file_list_unlock();
2168         module_put(tty->driver->owner);
2169         free_tty_struct(tty);
2170 }
2171
2172 /*
2173  * Even releasing the tty structures is a tricky business.. We have
2174  * to be very careful that the structures are all released at the
2175  * same time, as interrupts might otherwise get the wrong pointers.
2176  *
2177  * WSH 09/09/97: rewritten to avoid some nasty race conditions that could
2178  * lead to double frees or releasing memory still in use.
2179  */
2180 static void release_dev(struct file * filp)
2181 {
2182         struct tty_struct *tty, *o_tty;
2183         int     pty_master, tty_closing, o_tty_closing, do_sleep;
2184         int     devpts;
2185         int     idx;
2186         char    buf[64];
2187         unsigned long flags;
2188         
2189         tty = (struct tty_struct *)filp->private_data;
2190         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "release_dev"))
2191                 return;
2192
2193         check_tty_count(tty, "release_dev");
2194
2195         tty_fasync(-1, filp, 0);
2196
2197         idx = tty->index;
2198         pty_master = (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2199                       tty->driver->subtype == PTY_TYPE_MASTER);
2200         devpts = (tty->driver->flags & TTY_DRIVER_DEVPTS_MEM) != 0;
2201         o_tty = tty->link;
2202
2203 #ifdef TTY_PARANOIA_CHECK
2204         if (idx < 0 || idx >= tty->driver->num) {
2205                 printk(KERN_DEBUG "release_dev: bad idx when trying to "
2206                                   "free (%s)\n", tty->name);
2207                 return;
2208         }
2209         if (!(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
2210                 if (tty != tty->driver->ttys[idx]) {
2211                         printk(KERN_DEBUG "release_dev: driver.table[%d] not tty "
2212                                "for (%s)\n", idx, tty->name);
2213                         return;
2214                 }
2215                 if (tty->termios != tty->driver->termios[idx]) {
2216                         printk(KERN_DEBUG "release_dev: driver.termios[%d] not termios "
2217                                "for (%s)\n",
2218                                idx, tty->name);
2219                         return;
2220                 }
2221                 if (tty->termios_locked != tty->driver->termios_locked[idx]) {
2222                         printk(KERN_DEBUG "release_dev: driver.termios_locked[%d] not "
2223                                "termios_locked for (%s)\n",
2224                                idx, tty->name);
2225                         return;
2226                 }
2227         }
2228 #endif
2229
2230 #ifdef TTY_DEBUG_HANGUP
2231         printk(KERN_DEBUG "release_dev of %s (tty count=%d)...",
2232                tty_name(tty, buf), tty->count);
2233 #endif
2234
2235 #ifdef TTY_PARANOIA_CHECK
2236         if (tty->driver->other &&
2237              !(tty->driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
2238                 if (o_tty != tty->driver->other->ttys[idx]) {
2239                         printk(KERN_DEBUG "release_dev: other->table[%d] "
2240                                           "not o_tty for (%s)\n",
2241                                idx, tty->name);
2242                         return;
2243                 }
2244                 if (o_tty->termios != tty->driver->other->termios[idx]) {
2245                         printk(KERN_DEBUG "release_dev: other->termios[%d] "
2246                                           "not o_termios for (%s)\n",
2247                                idx, tty->name);
2248                         return;
2249                 }
2250                 if (o_tty->termios_locked != 
2251                       tty->driver->other->termios_locked[idx]) {
2252                         printk(KERN_DEBUG "release_dev: other->termios_locked["
2253                                           "%d] not o_termios_locked for (%s)\n",
2254                                idx, tty->name);
2255                         return;
2256                 }
2257                 if (o_tty->link != tty) {
2258                         printk(KERN_DEBUG "release_dev: bad pty pointers\n");
2259                         return;
2260                 }
2261         }
2262 #endif
2263         if (tty->driver->close)
2264                 tty->driver->close(tty, filp);
2265
2266         /*
2267          * Sanity check: if tty->count is going to zero, there shouldn't be
2268          * any waiters on tty->read_wait or tty->write_wait.  We test the
2269          * wait queues and kick everyone out _before_ actually starting to
2270          * close.  This ensures that we won't block while releasing the tty
2271          * structure.
2272          *
2273          * The test for the o_tty closing is necessary, since the master and
2274          * slave sides may close in any order.  If the slave side closes out
2275          * first, its count will be one, since the master side holds an open.
2276          * Thus this test wouldn't be triggered at the time the slave closes,
2277          * so we do it now.
2278          *
2279          * Note that it's possible for the tty to be opened again while we're
2280          * flushing out waiters.  By recalculating the closing flags before
2281          * each iteration we avoid any problems.
2282          */
2283         while (1) {
2284                 /* Guard against races with tty->count changes elsewhere and
2285                    opens on /dev/tty */
2286                    
2287                 mutex_lock(&tty_mutex);
2288                 tty_closing = tty->count <= 1;
2289                 o_tty_closing = o_tty &&
2290                         (o_tty->count <= (pty_master ? 1 : 0));
2291                 do_sleep = 0;
2292
2293                 if (tty_closing) {
2294                         if (waitqueue_active(&tty->read_wait)) {
2295                                 wake_up(&tty->read_wait);
2296                                 do_sleep++;
2297                         }
2298                         if (waitqueue_active(&tty->write_wait)) {
2299                                 wake_up(&tty->write_wait);
2300                                 do_sleep++;
2301                         }
2302                 }
2303                 if (o_tty_closing) {
2304                         if (waitqueue_active(&o_tty->read_wait)) {
2305                                 wake_up(&o_tty->read_wait);
2306                                 do_sleep++;
2307                         }
2308                         if (waitqueue_active(&o_tty->write_wait)) {
2309                                 wake_up(&o_tty->write_wait);
2310                                 do_sleep++;
2311                         }
2312                 }
2313                 if (!do_sleep)
2314                         break;
2315
2316                 printk(KERN_WARNING "release_dev: %s: read/write wait queue "
2317                                     "active!\n", tty_name(tty, buf));
2318                 mutex_unlock(&tty_mutex);
2319                 schedule();
2320         }       
2321
2322         /*
2323          * The closing flags are now consistent with the open counts on 
2324          * both sides, and we've completed the last operation that could 
2325          * block, so it's safe to proceed with closing.
2326          */
2327         if (pty_master) {
2328                 if (--o_tty->count < 0) {
2329                         printk(KERN_WARNING "release_dev: bad pty slave count "
2330                                             "(%d) for %s\n",
2331                                o_tty->count, tty_name(o_tty, buf));
2332                         o_tty->count = 0;
2333                 }
2334         }
2335         if (--tty->count < 0) {
2336                 printk(KERN_WARNING "release_dev: bad tty->count (%d) for %s\n",
2337                        tty->count, tty_name(tty, buf));
2338                 tty->count = 0;
2339         }
2340         
2341         /*
2342          * We've decremented tty->count, so we need to remove this file
2343          * descriptor off the tty->tty_files list; this serves two
2344          * purposes:
2345          *  - check_tty_count sees the correct number of file descriptors
2346          *    associated with this tty.
2347          *  - do_tty_hangup no longer sees this file descriptor as
2348          *    something that needs to be handled for hangups.
2349          */
2350         file_kill(filp);
2351         filp->private_data = NULL;
2352
2353         /*
2354          * Perform some housekeeping before deciding whether to return.
2355          *
2356          * Set the TTY_CLOSING flag if this was the last open.  In the
2357          * case of a pty we may have to wait around for the other side
2358          * to close, and TTY_CLOSING makes sure we can't be reopened.
2359          */
2360         if(tty_closing)
2361                 set_bit(TTY_CLOSING, &tty->flags);
2362         if(o_tty_closing)
2363                 set_bit(TTY_CLOSING, &o_tty->flags);
2364
2365         /*
2366          * If _either_ side is closing, make sure there aren't any
2367          * processes that still think tty or o_tty is their controlling
2368          * tty.
2369          */
2370         if (tty_closing || o_tty_closing) {
2371                 read_lock(&tasklist_lock);
2372                 session_clear_tty(tty->session);
2373                 if (o_tty)
2374                         session_clear_tty(o_tty->session);
2375                 read_unlock(&tasklist_lock);
2376         }
2377
2378         mutex_unlock(&tty_mutex);
2379
2380         /* check whether both sides are closing ... */
2381         if (!tty_closing || (o_tty && !o_tty_closing))
2382                 return;
2383         
2384 #ifdef TTY_DEBUG_HANGUP
2385         printk(KERN_DEBUG "freeing tty structure...");
2386 #endif
2387         /*
2388          * Prevent flush_to_ldisc() from rescheduling the work for later.  Then
2389          * kill any delayed work. As this is the final close it does not
2390          * race with the set_ldisc code path.
2391          */
2392         clear_bit(TTY_LDISC, &tty->flags);
2393         cancel_delayed_work(&tty->buf.work);
2394
2395         /*
2396          * Wait for ->hangup_work and ->buf.work handlers to terminate
2397          */
2398          
2399         flush_scheduled_work();
2400         
2401         /*
2402          * Wait for any short term users (we know they are just driver
2403          * side waiters as the file is closing so user count on the file
2404          * side is zero.
2405          */
2406         spin_lock_irqsave(&tty_ldisc_lock, flags);
2407         while(tty->ldisc.refcount)
2408         {
2409                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
2410                 wait_event(tty_ldisc_wait, tty->ldisc.refcount == 0);
2411                 spin_lock_irqsave(&tty_ldisc_lock, flags);
2412         }
2413         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
2414         /*
2415          * Shutdown the current line discipline, and reset it to N_TTY.
2416          * N.B. why reset ldisc when we're releasing the memory??
2417          *
2418          * FIXME: this MUST get fixed for the new reflocking
2419          */
2420         if (tty->ldisc.close)
2421                 (tty->ldisc.close)(tty);
2422         tty_ldisc_put(tty->ldisc.num);
2423         
2424         /*
2425          *      Switch the line discipline back
2426          */
2427         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
2428         tty_set_termios_ldisc(tty,N_TTY); 
2429         if (o_tty) {
2430                 /* FIXME: could o_tty be in setldisc here ? */
2431                 clear_bit(TTY_LDISC, &o_tty->flags);
2432                 if (o_tty->ldisc.close)
2433                         (o_tty->ldisc.close)(o_tty);
2434                 tty_ldisc_put(o_tty->ldisc.num);
2435                 tty_ldisc_assign(o_tty, tty_ldisc_get(N_TTY));
2436                 tty_set_termios_ldisc(o_tty,N_TTY); 
2437         }
2438         /*
2439          * The release_mem function takes care of the details of clearing
2440          * the slots and preserving the termios structure.
2441          */
2442         release_mem(tty, idx);
2443
2444 #ifdef CONFIG_UNIX98_PTYS
2445         /* Make this pty number available for reallocation */
2446         if (devpts) {
2447                 down(&allocated_ptys_lock);
2448                 idr_remove(&allocated_ptys, idx);
2449                 up(&allocated_ptys_lock);
2450         }
2451 #endif
2452
2453 }
2454
2455 /**
2456  *      tty_open                -       open a tty device
2457  *      @inode: inode of device file
2458  *      @filp: file pointer to tty
2459  *
2460  *      tty_open and tty_release keep up the tty count that contains the
2461  *      number of opens done on a tty. We cannot use the inode-count, as
2462  *      different inodes might point to the same tty.
2463  *
2464  *      Open-counting is needed for pty masters, as well as for keeping
2465  *      track of serial lines: DTR is dropped when the last close happens.
2466  *      (This is not done solely through tty->count, now.  - Ted 1/27/92)
2467  *
2468  *      The termios state of a pty is reset on first open so that
2469  *      settings don't persist across reuse.
2470  *
2471  *      Locking: tty_mutex protects tty, get_tty_driver and init_dev work.
2472  *               tty->count should protect the rest.
2473  *               ->siglock protects ->signal/->sighand
2474  */
2475
2476 static int tty_open(struct inode * inode, struct file * filp)
2477 {
2478         struct tty_struct *tty;
2479         int noctty, retval;
2480         struct tty_driver *driver;
2481         int index;
2482         dev_t device = inode->i_rdev;
2483         unsigned short saved_flags = filp->f_flags;
2484
2485         nonseekable_open(inode, filp);
2486         
2487 retry_open:
2488         noctty = filp->f_flags & O_NOCTTY;
2489         index  = -1;
2490         retval = 0;
2491         
2492         mutex_lock(&tty_mutex);
2493
2494         if (device == MKDEV(TTYAUX_MAJOR,0)) {
2495                 tty = get_current_tty();
2496                 if (!tty) {
2497                         mutex_unlock(&tty_mutex);
2498                         return -ENXIO;
2499                 }
2500                 driver = tty->driver;
2501                 index = tty->index;
2502                 filp->f_flags |= O_NONBLOCK; /* Don't let /dev/tty block */
2503                 /* noctty = 1; */
2504                 goto got_driver;
2505         }
2506 #ifdef CONFIG_VT
2507         if (device == MKDEV(TTY_MAJOR,0)) {
2508                 extern struct tty_driver *console_driver;
2509                 driver = console_driver;
2510                 index = fg_console;
2511                 noctty = 1;
2512                 goto got_driver;
2513         }
2514 #endif
2515         if (device == MKDEV(TTYAUX_MAJOR,1)) {
2516                 driver = console_device(&index);
2517                 if (driver) {
2518                         /* Don't let /dev/console block */
2519                         filp->f_flags |= O_NONBLOCK;
2520                         noctty = 1;
2521                         goto got_driver;
2522                 }
2523                 mutex_unlock(&tty_mutex);
2524                 return -ENODEV;
2525         }
2526
2527         driver = get_tty_driver(device, &index);
2528         if (!driver) {
2529                 mutex_unlock(&tty_mutex);
2530                 return -ENODEV;
2531         }
2532 got_driver:
2533         retval = init_dev(driver, index, &tty);
2534         mutex_unlock(&tty_mutex);
2535         if (retval)
2536                 return retval;
2537
2538         filp->private_data = tty;
2539         file_move(filp, &tty->tty_files);
2540         check_tty_count(tty, "tty_open");
2541         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
2542             tty->driver->subtype == PTY_TYPE_MASTER)
2543                 noctty = 1;
2544 #ifdef TTY_DEBUG_HANGUP
2545         printk(KERN_DEBUG "opening %s...", tty->name);
2546 #endif
2547         if (!retval) {
2548                 if (tty->driver->open)
2549                         retval = tty->driver->open(tty, filp);
2550                 else
2551                         retval = -ENODEV;
2552         }
2553         filp->f_flags = saved_flags;
2554
2555         if (!retval && test_bit(TTY_EXCLUSIVE, &tty->flags) && !capable(CAP_SYS_ADMIN))
2556                 retval = -EBUSY;
2557
2558         if (retval) {
2559 #ifdef TTY_DEBUG_HANGUP
2560                 printk(KERN_DEBUG "error %d in opening %s...", retval,
2561                        tty->name);
2562 #endif
2563                 release_dev(filp);
2564                 if (retval != -ERESTARTSYS)
2565                         return retval;
2566                 if (signal_pending(current))
2567                         return retval;
2568                 schedule();
2569                 /*
2570                  * Need to reset f_op in case a hangup happened.
2571                  */
2572                 if (filp->f_op == &hung_up_tty_fops)
2573                         filp->f_op = &tty_fops;
2574                 goto retry_open;
2575         }
2576
2577         mutex_lock(&tty_mutex);
2578         spin_lock_irq(&current->sighand->siglock);
2579         if (!noctty &&
2580             current->signal->leader &&
2581             !current->signal->tty &&
2582             tty->session == 0)
2583                 __proc_set_tty(current, tty);
2584         spin_unlock_irq(&current->sighand->siglock);
2585         mutex_unlock(&tty_mutex);
2586         return 0;
2587 }
2588
2589 #ifdef CONFIG_UNIX98_PTYS
2590 /**
2591  *      ptmx_open               -       open a unix 98 pty master
2592  *      @inode: inode of device file
2593  *      @filp: file pointer to tty
2594  *
2595  *      Allocate a unix98 pty master device from the ptmx driver.
2596  *
2597  *      Locking: tty_mutex protects theinit_dev work. tty->count should
2598                 protect the rest.
2599  *              allocated_ptys_lock handles the list of free pty numbers
2600  */
2601
2602 static int ptmx_open(struct inode * inode, struct file * filp)
2603 {
2604         struct tty_struct *tty;
2605         int retval;
2606         int index;
2607         int idr_ret;
2608
2609         nonseekable_open(inode, filp);
2610
2611         /* find a device that is not in use. */
2612         down(&allocated_ptys_lock);
2613         if (!idr_pre_get(&allocated_ptys, GFP_KERNEL)) {
2614                 up(&allocated_ptys_lock);
2615                 return -ENOMEM;
2616         }
2617         idr_ret = idr_get_new(&allocated_ptys, NULL, &index);
2618         if (idr_ret < 0) {
2619                 up(&allocated_ptys_lock);
2620                 if (idr_ret == -EAGAIN)
2621                         return -ENOMEM;
2622                 return -EIO;
2623         }
2624         if (index >= pty_limit) {
2625                 idr_remove(&allocated_ptys, index);
2626                 up(&allocated_ptys_lock);
2627                 return -EIO;
2628         }
2629         up(&allocated_ptys_lock);
2630
2631         mutex_lock(&tty_mutex);
2632         retval = init_dev(ptm_driver, index, &tty);
2633         mutex_unlock(&tty_mutex);
2634         
2635         if (retval)
2636                 goto out;
2637
2638         set_bit(TTY_PTY_LOCK, &tty->flags); /* LOCK THE SLAVE */
2639         filp->private_data = tty;
2640         file_move(filp, &tty->tty_files);
2641
2642         retval = -ENOMEM;
2643         if (devpts_pty_new(tty->link))
2644                 goto out1;
2645
2646         check_tty_count(tty, "tty_open");
2647         retval = ptm_driver->open(tty, filp);
2648         if (!retval)
2649                 return 0;
2650 out1:
2651         release_dev(filp);
2652         return retval;
2653 out:
2654         down(&allocated_ptys_lock);
2655         idr_remove(&allocated_ptys, index);
2656         up(&allocated_ptys_lock);
2657         return retval;
2658 }
2659 #endif
2660
2661 /**
2662  *      tty_release             -       vfs callback for close
2663  *      @inode: inode of tty
2664  *      @filp: file pointer for handle to tty
2665  *
2666  *      Called the last time each file handle is closed that references
2667  *      this tty. There may however be several such references.
2668  *
2669  *      Locking:
2670  *              Takes bkl. See release_dev
2671  */
2672
2673 static int tty_release(struct inode * inode, struct file * filp)
2674 {
2675         lock_kernel();
2676         release_dev(filp);
2677         unlock_kernel();
2678         return 0;
2679 }
2680
2681 /**
2682  *      tty_poll        -       check tty status
2683  *      @filp: file being polled
2684  *      @wait: poll wait structures to update
2685  *
2686  *      Call the line discipline polling method to obtain the poll
2687  *      status of the device.
2688  *
2689  *      Locking: locks called line discipline but ldisc poll method
2690  *      may be re-entered freely by other callers.
2691  */
2692
2693 static unsigned int tty_poll(struct file * filp, poll_table * wait)
2694 {
2695         struct tty_struct * tty;
2696         struct tty_ldisc *ld;
2697         int ret = 0;
2698
2699         tty = (struct tty_struct *)filp->private_data;
2700         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_poll"))
2701                 return 0;
2702                 
2703         ld = tty_ldisc_ref_wait(tty);
2704         if (ld->poll)
2705                 ret = (ld->poll)(tty, filp, wait);
2706         tty_ldisc_deref(ld);
2707         return ret;
2708 }
2709
2710 static int tty_fasync(int fd, struct file * filp, int on)
2711 {
2712         struct tty_struct * tty;
2713         int retval;
2714
2715         tty = (struct tty_struct *)filp->private_data;
2716         if (tty_paranoia_check(tty, filp->f_path.dentry->d_inode, "tty_fasync"))
2717                 return 0;
2718         
2719         retval = fasync_helper(fd, filp, on, &tty->fasync);
2720         if (retval <= 0)
2721                 return retval;
2722
2723         if (on) {
2724                 if (!waitqueue_active(&tty->read_wait))
2725                         tty->minimum_to_wake = 1;
2726                 retval = f_setown(filp, (-tty->pgrp) ? : current->pid, 0);
2727                 if (retval)
2728                         return retval;
2729         } else {
2730                 if (!tty->fasync && !waitqueue_active(&tty->read_wait))
2731                         tty->minimum_to_wake = N_TTY_BUF_SIZE;
2732         }
2733         return 0;
2734 }
2735
2736 /**
2737  *      tiocsti                 -       fake input character
2738  *      @tty: tty to fake input into
2739  *      @p: pointer to character
2740  *
2741  *      Fake input to a tty device. Does the neccessary locking and
2742  *      input management.
2743  *
2744  *      FIXME: does not honour flow control ??
2745  *
2746  *      Locking:
2747  *              Called functions take tty_ldisc_lock
2748  *              current->signal->tty check is safe without locks
2749  *
2750  *      FIXME: may race normal receive processing
2751  */
2752
2753 static int tiocsti(struct tty_struct *tty, char __user *p)
2754 {
2755         char ch, mbz = 0;
2756         struct tty_ldisc *ld;
2757         
2758         if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
2759                 return -EPERM;
2760         if (get_user(ch, p))
2761                 return -EFAULT;
2762         ld = tty_ldisc_ref_wait(tty);
2763         ld->receive_buf(tty, &ch, &mbz, 1);
2764         tty_ldisc_deref(ld);
2765         return 0;
2766 }
2767
2768 /**
2769  *      tiocgwinsz              -       implement window query ioctl
2770  *      @tty; tty
2771  *      @arg: user buffer for result
2772  *
2773  *      Copies the kernel idea of the window size into the user buffer.
2774  *
2775  *      Locking: tty->termios_mutex is taken to ensure the winsize data
2776  *              is consistent.
2777  */
2778
2779 static int tiocgwinsz(struct tty_struct *tty, struct winsize __user * arg)
2780 {
2781         int err;
2782
2783         mutex_lock(&tty->termios_mutex);
2784         err = copy_to_user(arg, &tty->winsize, sizeof(*arg));
2785         mutex_unlock(&tty->termios_mutex);
2786
2787         return err ? -EFAULT: 0;
2788 }
2789
2790 /**
2791  *      tiocswinsz              -       implement window size set ioctl
2792  *      @tty; tty
2793  *      @arg: user buffer for result
2794  *
2795  *      Copies the user idea of the window size to the kernel. Traditionally
2796  *      this is just advisory information but for the Linux console it
2797  *      actually has driver level meaning and triggers a VC resize.
2798  *
2799  *      Locking:
2800  *              Called function use the console_sem is used to ensure we do
2801  *      not try and resize the console twice at once.
2802  *              The tty->termios_mutex is used to ensure we don't double
2803  *      resize and get confused. Lock order - tty->termios_mutex before
2804  *      console sem
2805  */
2806
2807 static int tiocswinsz(struct tty_struct *tty, struct tty_struct *real_tty,
2808         struct winsize __user * arg)
2809 {
2810         struct winsize tmp_ws;
2811
2812         if (copy_from_user(&tmp_ws, arg, sizeof(*arg)))
2813                 return -EFAULT;
2814
2815         mutex_lock(&tty->termios_mutex);
2816         if (!memcmp(&tmp_ws, &tty->winsize, sizeof(*arg)))
2817                 goto done;
2818
2819 #ifdef CONFIG_VT
2820         if (tty->driver->type == TTY_DRIVER_TYPE_CONSOLE) {
2821                 if (vc_lock_resize(tty->driver_data, tmp_ws.ws_col,
2822                                         tmp_ws.ws_row)) {
2823                         mutex_unlock(&tty->termios_mutex);
2824                         return -ENXIO;
2825                 }
2826         }
2827 #endif
2828         if (tty->pgrp > 0)
2829                 kill_pg(tty->pgrp, SIGWINCH, 1);
2830         if ((real_tty->pgrp != tty->pgrp) && (real_tty->pgrp > 0))
2831                 kill_pg(real_tty->pgrp, SIGWINCH, 1);
2832         tty->winsize = tmp_ws;
2833         real_tty->winsize = tmp_ws;
2834 done:
2835         mutex_unlock(&tty->termios_mutex);
2836         return 0;
2837 }
2838
2839 /**
2840  *      tioccons        -       allow admin to move logical console
2841  *      @file: the file to become console
2842  *
2843  *      Allow the adminstrator to move the redirected console device
2844  *
2845  *      Locking: uses redirect_lock to guard the redirect information
2846  */
2847
2848 static int tioccons(struct file *file)
2849 {
2850         if (!capable(CAP_SYS_ADMIN))
2851                 return -EPERM;
2852         if (file->f_op->write == redirected_tty_write) {
2853                 struct file *f;
2854                 spin_lock(&redirect_lock);
2855                 f = redirect;
2856                 redirect = NULL;
2857                 spin_unlock(&redirect_lock);
2858                 if (f)
2859                         fput(f);
2860                 return 0;
2861         }
2862         spin_lock(&redirect_lock);
2863         if (redirect) {
2864                 spin_unlock(&redirect_lock);
2865                 return -EBUSY;
2866         }
2867         get_file(file);
2868         redirect = file;
2869         spin_unlock(&redirect_lock);
2870         return 0;
2871 }
2872
2873 /**
2874  *      fionbio         -       non blocking ioctl
2875  *      @file: file to set blocking value
2876  *      @p: user parameter
2877  *
2878  *      Historical tty interfaces had a blocking control ioctl before
2879  *      the generic functionality existed. This piece of history is preserved
2880  *      in the expected tty API of posix OS's.
2881  *
2882  *      Locking: none, the open fle handle ensures it won't go away.
2883  */
2884
2885 static int fionbio(struct file *file, int __user *p)
2886 {
2887         int nonblock;
2888
2889         if (get_user(nonblock, p))
2890                 return -EFAULT;
2891
2892         if (nonblock)
2893                 file->f_flags |= O_NONBLOCK;
2894         else
2895                 file->f_flags &= ~O_NONBLOCK;
2896         return 0;
2897 }
2898
2899 /**
2900  *      tiocsctty       -       set controlling tty
2901  *      @tty: tty structure
2902  *      @arg: user argument
2903  *
2904  *      This ioctl is used to manage job control. It permits a session
2905  *      leader to set this tty as the controlling tty for the session.
2906  *
2907  *      Locking:
2908  *              Takes tty_mutex() to protect tty instance
2909  *              Takes tasklist_lock internally to walk sessions
2910  *              Takes ->siglock() when updating signal->tty
2911  */
2912
2913 static int tiocsctty(struct tty_struct *tty, int arg)
2914 {
2915         int ret = 0;
2916         if (current->signal->leader &&
2917                         (process_session(current) == tty->session))
2918                 return ret;
2919
2920         mutex_lock(&tty_mutex);
2921         /*
2922          * The process must be a session leader and
2923          * not have a controlling tty already.
2924          */
2925         if (!current->signal->leader || current->signal->tty) {
2926                 ret = -EPERM;
2927                 goto unlock;
2928         }
2929
2930         if (tty->session > 0) {
2931                 /*
2932                  * This tty is already the controlling
2933                  * tty for another session group!
2934                  */
2935                 if ((arg == 1) && capable(CAP_SYS_ADMIN)) {
2936                         /*
2937                          * Steal it away
2938                          */
2939                         read_lock(&tasklist_lock);
2940                         session_clear_tty(tty->session);
2941                         read_unlock(&tasklist_lock);
2942                 } else {
2943                         ret = -EPERM;
2944                         goto unlock;
2945                 }
2946         }
2947         proc_set_tty(current, tty);
2948 unlock:
2949         mutex_unlock(&tty_mutex);
2950         return ret;
2951 }
2952
2953 /**
2954  *      tiocgpgrp               -       get process group
2955  *      @tty: tty passed by user
2956  *      @real_tty: tty side of the tty pased by the user if a pty else the tty
2957  *      @p: returned pid
2958  *
2959  *      Obtain the process group of the tty. If there is no process group
2960  *      return an error.
2961  *
2962  *      Locking: none. Reference to current->signal->tty is safe.
2963  */
2964
2965 static int tiocgpgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2966 {
2967         /*
2968          * (tty == real_tty) is a cheap way of
2969          * testing if the tty is NOT a master pty.
2970          */
2971         if (tty == real_tty && current->signal->tty != real_tty)
2972                 return -ENOTTY;
2973         return put_user(real_tty->pgrp, p);
2974 }
2975
2976 /**
2977  *      tiocspgrp               -       attempt to set process group
2978  *      @tty: tty passed by user
2979  *      @real_tty: tty side device matching tty passed by user
2980  *      @p: pid pointer
2981  *
2982  *      Set the process group of the tty to the session passed. Only
2983  *      permitted where the tty session is our session.
2984  *
2985  *      Locking: None
2986  */
2987
2988 static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
2989 {
2990         pid_t pgrp;
2991         int retval = tty_check_change(real_tty);
2992
2993         if (retval == -EIO)
2994                 return -ENOTTY;
2995         if (retval)
2996                 return retval;
2997         if (!current->signal->tty ||
2998             (current->signal->tty != real_tty) ||
2999             (real_tty->session != process_session(current)))
3000                 return -ENOTTY;
3001         if (get_user(pgrp, p))
3002                 return -EFAULT;
3003         if (pgrp < 0)
3004                 return -EINVAL;
3005         if (session_of_pgrp(pgrp) != process_session(current))
3006                 return -EPERM;
3007         real_tty->pgrp = pgrp;
3008         return 0;
3009 }
3010
3011 /**
3012  *      tiocgsid                -       get session id
3013  *      @tty: tty passed by user
3014  *      @real_tty: tty side of the tty pased by the user if a pty else the tty
3015  *      @p: pointer to returned session id
3016  *
3017  *      Obtain the session id of the tty. If there is no session
3018  *      return an error.
3019  *
3020  *      Locking: none. Reference to current->signal->tty is safe.
3021  */
3022
3023 static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
3024 {
3025         /*
3026          * (tty == real_tty) is a cheap way of
3027          * testing if the tty is NOT a master pty.
3028         */
3029         if (tty == real_tty && current->signal->tty != real_tty)
3030                 return -ENOTTY;
3031         if (real_tty->session <= 0)
3032                 return -ENOTTY;
3033         return put_user(real_tty->session, p);
3034 }
3035
3036 /**
3037  *      tiocsetd        -       set line discipline
3038  *      @tty: tty device
3039  *      @p: pointer to user data
3040  *
3041  *      Set the line discipline according to user request.
3042  *
3043  *      Locking: see tty_set_ldisc, this function is just a helper
3044  */
3045
3046 static int tiocsetd(struct tty_struct *tty, int __user *p)
3047 {
3048         int ldisc;
3049
3050         if (get_user(ldisc, p))
3051                 return -EFAULT;
3052         return tty_set_ldisc(tty, ldisc);
3053 }
3054
3055 /**
3056  *      send_break      -       performed time break
3057  *      @tty: device to break on
3058  *      @duration: timeout in mS
3059  *
3060  *      Perform a timed break on hardware that lacks its own driver level
3061  *      timed break functionality.
3062  *
3063  *      Locking:
3064  *              atomic_write_lock serializes
3065  *
3066  */
3067
3068 static int send_break(struct tty_struct *tty, unsigned int duration)
3069 {
3070         if (mutex_lock_interruptible(&tty->atomic_write_lock))
3071                 return -EINTR;
3072         tty->driver->break_ctl(tty, -1);
3073         if (!signal_pending(current)) {
3074                 msleep_interruptible(duration);
3075         }
3076         tty->driver->break_ctl(tty, 0);
3077         mutex_unlock(&tty->atomic_write_lock);
3078         if (signal_pending(current))
3079                 return -EINTR;
3080         return 0;
3081 }
3082
3083 /**
3084  *      tiocmget                -       get modem status
3085  *      @tty: tty device
3086  *      @file: user file pointer
3087  *      @p: pointer to result
3088  *
3089  *      Obtain the modem status bits from the tty driver if the feature
3090  *      is supported. Return -EINVAL if it is not available.
3091  *
3092  *      Locking: none (up to the driver)
3093  */
3094
3095 static int tty_tiocmget(struct tty_struct *tty, struct file *file, int __user *p)
3096 {
3097         int retval = -EINVAL;
3098
3099         if (tty->driver->tiocmget) {
3100                 retval = tty->driver->tiocmget(tty, file);
3101
3102                 if (retval >= 0)
3103                         retval = put_user(retval, p);
3104         }
3105         return retval;
3106 }
3107
3108 /**
3109  *      tiocmset                -       set modem status
3110  *      @tty: tty device
3111  *      @file: user file pointer
3112  *      @cmd: command - clear bits, set bits or set all
3113  *      @p: pointer to desired bits
3114  *
3115  *      Set the modem status bits from the tty driver if the feature
3116  *      is supported. Return -EINVAL if it is not available.
3117  *
3118  *      Locking: none (up to the driver)
3119  */
3120
3121 static int tty_tiocmset(struct tty_struct *tty, struct file *file, unsigned int cmd,
3122              unsigned __user *p)
3123 {
3124         int retval = -EINVAL;
3125
3126         if (tty->driver->tiocmset) {
3127                 unsigned int set, clear, val;
3128
3129                 retval = get_user(val, p);
3130                 if (retval)
3131                         return retval;
3132
3133                 set = clear = 0;
3134                 switch (cmd) {
3135                 case TIOCMBIS:
3136                         set = val;
3137                         break;
3138                 case TIOCMBIC:
3139                         clear = val;
3140                         break;
3141                 case TIOCMSET:
3142                         set = val;
3143                         clear = ~val;
3144                         break;
3145                 }
3146
3147                 set &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
3148                 clear &= TIOCM_DTR|TIOCM_RTS|TIOCM_OUT1|TIOCM_OUT2|TIOCM_LOOP;
3149
3150                 retval = tty->driver->tiocmset(tty, file, set, clear);
3151         }
3152         return retval;
3153 }
3154
3155 /*
3156  * Split this up, as gcc can choke on it otherwise..
3157  */
3158 int tty_ioctl(struct inode * inode, struct file * file,
3159               unsigned int cmd, unsigned long arg)
3160 {
3161         struct tty_struct *tty, *real_tty;
3162         void __user *p = (void __user *)arg;
3163         int retval;
3164         struct tty_ldisc *ld;
3165         
3166         tty = (struct tty_struct *)file->private_data;
3167         if (tty_paranoia_check(tty, inode, "tty_ioctl"))
3168                 return -EINVAL;
3169
3170         /* CHECKME: is this safe as one end closes ? */
3171
3172         real_tty = tty;
3173         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
3174             tty->driver->subtype == PTY_TYPE_MASTER)
3175                 real_tty = tty->link;
3176
3177         /*
3178          * Break handling by driver
3179          */
3180         if (!tty->driver->break_ctl) {
3181                 switch(cmd) {
3182                 case TIOCSBRK:
3183                 case TIOCCBRK:
3184                         if (tty->driver->ioctl)
3185                                 return tty->driver->ioctl(tty, file, cmd, arg);
3186                         return -EINVAL;
3187                         
3188                 /* These two ioctl's always return success; even if */
3189                 /* the driver doesn't support them. */
3190                 case TCSBRK:
3191                 case TCSBRKP:
3192                         if (!tty->driver->ioctl)
3193                                 return 0;
3194                         retval = tty->driver->ioctl(tty, file, cmd, arg);
3195                         if (retval == -ENOIOCTLCMD)
3196                                 retval = 0;
3197                         return retval;
3198                 }
3199         }
3200
3201         /*
3202          * Factor out some common prep work
3203          */
3204         switch (cmd) {
3205         case TIOCSETD:
3206         case TIOCSBRK:
3207         case TIOCCBRK:
3208         case TCSBRK:
3209         case TCSBRKP:                   
3210                 retval = tty_check_change(tty);
3211                 if (retval)
3212                         return retval;
3213                 if (cmd != TIOCCBRK) {
3214                         tty_wait_until_sent(tty, 0);
3215                         if (signal_pending(current))
3216                                 return -EINTR;
3217                 }
3218                 break;
3219         }
3220
3221         switch (cmd) {
3222                 case TIOCSTI:
3223                         return tiocsti(tty, p);
3224                 case TIOCGWINSZ:
3225                         return tiocgwinsz(tty, p);
3226                 case TIOCSWINSZ:
3227                         return tiocswinsz(tty, real_tty, p);
3228                 case TIOCCONS:
3229                         return real_tty!=tty ? -EINVAL : tioccons(file);
3230                 case FIONBIO:
3231                         return fionbio(file, p);
3232                 case TIOCEXCL:
3233                         set_bit(TTY_EXCLUSIVE, &tty->flags);
3234                         return 0;
3235                 case TIOCNXCL:
3236                         clear_bit(TTY_EXCLUSIVE, &tty->flags);
3237                         return 0;
3238                 case TIOCNOTTY:
3239                         if (current->signal->tty != tty)
3240                                 return -ENOTTY;
3241                         if (current->signal->leader)
3242                                 disassociate_ctty(0);
3243                         proc_clear_tty(current);
3244                         return 0;
3245                 case TIOCSCTTY:
3246                         return tiocsctty(tty, arg);
3247                 case TIOCGPGRP:
3248                         return tiocgpgrp(tty, real_tty, p);
3249                 case TIOCSPGRP:
3250                         return tiocspgrp(tty, real_tty, p);
3251                 case TIOCGSID:
3252                         return tiocgsid(tty, real_tty, p);
3253                 case TIOCGETD:
3254                         /* FIXME: check this is ok */
3255                         return put_user(tty->ldisc.num, (int __user *)p);
3256                 case TIOCSETD:
3257                         return tiocsetd(tty, p);
3258 #ifdef CONFIG_VT
3259                 case TIOCLINUX:
3260                         return tioclinux(tty, arg);
3261 #endif
3262                 /*
3263                  * Break handling
3264                  */
3265                 case TIOCSBRK:  /* Turn break on, unconditionally */
3266                         tty->driver->break_ctl(tty, -1);
3267                         return 0;
3268                         
3269                 case TIOCCBRK:  /* Turn break off, unconditionally */
3270                         tty->driver->break_ctl(tty, 0);
3271                         return 0;
3272                 case TCSBRK:   /* SVID version: non-zero arg --> no break */
3273                         /* non-zero arg means wait for all output data
3274                          * to be sent (performed above) but don't send break.
3275                          * This is used by the tcdrain() termios function.
3276                          */
3277                         if (!arg)
3278                                 return send_break(tty, 250);
3279                         return 0;
3280                 case TCSBRKP:   /* support for POSIX tcsendbreak() */   
3281                         return send_break(tty, arg ? arg*100 : 250);
3282
3283                 case TIOCMGET:
3284                         return tty_tiocmget(tty, file, p);
3285
3286                 case TIOCMSET:
3287                 case TIOCMBIC:
3288                 case TIOCMBIS:
3289                         return tty_tiocmset(tty, file, cmd, p);
3290         }
3291         if (tty->driver->ioctl) {
3292                 retval = (tty->driver->ioctl)(tty, file, cmd, arg);
3293                 if (retval != -ENOIOCTLCMD)
3294                         return retval;
3295         }
3296         ld = tty_ldisc_ref_wait(tty);
3297         retval = -EINVAL;
3298         if (ld->ioctl) {
3299                 retval = ld->ioctl(tty, file, cmd, arg);
3300                 if (retval == -ENOIOCTLCMD)
3301                         retval = -EINVAL;
3302         }
3303         tty_ldisc_deref(ld);
3304         return retval;
3305 }
3306
3307
3308 /*
3309  * This implements the "Secure Attention Key" ---  the idea is to
3310  * prevent trojan horses by killing all processes associated with this
3311  * tty when the user hits the "Secure Attention Key".  Required for
3312  * super-paranoid applications --- see the Orange Book for more details.
3313  * 
3314  * This code could be nicer; ideally it should send a HUP, wait a few
3315  * seconds, then send a INT, and then a KILL signal.  But you then
3316  * have to coordinate with the init process, since all processes associated
3317  * with the current tty must be dead before the new getty is allowed
3318  * to spawn.
3319  *
3320  * Now, if it would be correct ;-/ The current code has a nasty hole -
3321  * it doesn't catch files in flight. We may send the descriptor to ourselves
3322  * via AF_UNIX socket, close it and later fetch from socket. FIXME.
3323  *
3324  * Nasty bug: do_SAK is being called in interrupt context.  This can
3325  * deadlock.  We punt it up to process context.  AKPM - 16Mar2001
3326  */
3327 static void __do_SAK(struct work_struct *work)
3328 {
3329         struct tty_struct *tty =
3330                 container_of(work, struct tty_struct, SAK_work);
3331 #ifdef TTY_SOFT_SAK
3332         tty_hangup(tty);
3333 #else
3334         struct task_struct *g, *p;
3335         int session;
3336         int             i;
3337         struct file     *filp;
3338         struct fdtable *fdt;
3339         
3340         if (!tty)
3341                 return;
3342         session = tty->session;
3343         
3344         tty_ldisc_flush(tty);
3345
3346         if (tty->driver->flush_buffer)
3347                 tty->driver->flush_buffer(tty);
3348         
3349         read_lock(&tasklist_lock);
3350         /* Kill the entire session */
3351         do_each_task_pid(session, PIDTYPE_SID, p) {
3352                 printk(KERN_NOTICE "SAK: killed process %d"
3353                         " (%s): process_session(p)==tty->session\n",
3354                         p->pid, p->comm);
3355                 send_sig(SIGKILL, p, 1);
3356         } while_each_task_pid(session, PIDTYPE_SID, p);
3357         /* Now kill any processes that happen to have the
3358          * tty open.
3359          */
3360         do_each_thread(g, p) {
3361                 if (p->signal->tty == tty) {
3362                         printk(KERN_NOTICE "SAK: killed process %d"
3363                             " (%s): process_session(p)==tty->session\n",
3364                             p->pid, p->comm);
3365                         send_sig(SIGKILL, p, 1);
3366                         continue;
3367                 }
3368                 task_lock(p);
3369                 if (p->files) {
3370                         /*
3371                          * We don't take a ref to the file, so we must
3372                          * hold ->file_lock instead.
3373                          */
3374                         spin_lock(&p->files->file_lock);
3375                         fdt = files_fdtable(p->files);
3376                         for (i=0; i < fdt->max_fds; i++) {
3377                                 filp = fcheck_files(p->files, i);
3378                                 if (!filp)
3379                                         continue;
3380                                 if (filp->f_op->read == tty_read &&
3381                                     filp->private_data == tty) {
3382                                         printk(KERN_NOTICE "SAK: killed process %d"
3383                                             " (%s): fd#%d opened to the tty\n",
3384                                             p->pid, p->comm, i);
3385                                         force_sig(SIGKILL, p);
3386                                         break;
3387                                 }
3388                         }
3389                         spin_unlock(&p->files->file_lock);
3390                 }
3391                 task_unlock(p);
3392         } while_each_thread(g, p);
3393         read_unlock(&tasklist_lock);
3394 #endif
3395 }
3396
3397 /*
3398  * The tq handling here is a little racy - tty->SAK_work may already be queued.
3399  * Fortunately we don't need to worry, because if ->SAK_work is already queued,
3400  * the values which we write to it will be identical to the values which it
3401  * already has. --akpm
3402  */
3403 void do_SAK(struct tty_struct *tty)
3404 {
3405         if (!tty)
3406                 return;
3407         PREPARE_WORK(&tty->SAK_work, __do_SAK);
3408         schedule_work(&tty->SAK_work);
3409 }
3410
3411 EXPORT_SYMBOL(do_SAK);
3412
3413 /**
3414  *      flush_to_ldisc
3415  *      @work: tty structure passed from work queue.
3416  *
3417  *      This routine is called out of the software interrupt to flush data
3418  *      from the buffer chain to the line discipline.
3419  *
3420  *      Locking: holds tty->buf.lock to guard buffer list. Drops the lock
3421  *      while invoking the line discipline receive_buf method. The
3422  *      receive_buf method is single threaded for each tty instance.
3423  */
3424  
3425 static void flush_to_ldisc(struct work_struct *work)
3426 {
3427         struct tty_struct *tty =
3428                 container_of(work, struct tty_struct, buf.work.work);
3429         unsigned long   flags;
3430         struct tty_ldisc *disc;
3431         struct tty_buffer *tbuf, *head;
3432         char *char_buf;
3433         unsigned char *flag_buf;
3434
3435         disc = tty_ldisc_ref(tty);
3436         if (disc == NULL)       /*  !TTY_LDISC */
3437                 return;
3438
3439         spin_lock_irqsave(&tty->buf.lock, flags);
3440         head = tty->buf.head;
3441         if (head != NULL) {
3442                 tty->buf.head = NULL;
3443                 for (;;) {
3444                         int count = head->commit - head->read;
3445                         if (!count) {
3446                                 if (head->next == NULL)
3447                                         break;
3448                                 tbuf = head;
3449                                 head = head->next;
3450                                 tty_buffer_free(tty, tbuf);
3451                                 continue;
3452                         }
3453                         if (!tty->receive_room) {
3454                                 schedule_delayed_work(&tty->buf.work, 1);
3455                                 break;
3456                         }
3457                         if (count > tty->receive_room)
3458                                 count = tty->receive_room;
3459                         char_buf = head->char_buf_ptr + head->read;
3460                         flag_buf = head->flag_buf_ptr + head->read;
3461                         head->read += count;
3462                         spin_unlock_irqrestore(&tty->buf.lock, flags);
3463                         disc->receive_buf(tty, char_buf, flag_buf, count);
3464                         spin_lock_irqsave(&tty->buf.lock, flags);
3465                 }
3466                 tty->buf.head = head;
3467         }
3468         spin_unlock_irqrestore(&tty->buf.lock, flags);
3469
3470         tty_ldisc_deref(disc);
3471 }
3472
3473 /**
3474  *      tty_flip_buffer_push    -       terminal
3475  *      @tty: tty to push
3476  *
3477  *      Queue a push of the terminal flip buffers to the line discipline. This
3478  *      function must not be called from IRQ context if tty->low_latency is set.
3479  *
3480  *      In the event of the queue being busy for flipping the work will be
3481  *      held off and retried later.
3482  *
3483  *      Locking: tty buffer lock. Driver locks in low latency mode.
3484  */
3485
3486 void tty_flip_buffer_push(struct tty_struct *tty)
3487 {
3488         unsigned long flags;
3489         spin_lock_irqsave(&tty->buf.lock, flags);
3490         if (tty->buf.tail != NULL)
3491                 tty->buf.tail->commit = tty->buf.tail->used;
3492         spin_unlock_irqrestore(&tty->buf.lock, flags);
3493
3494         if (tty->low_latency)
3495                 flush_to_ldisc(&tty->buf.work.work);
3496         else
3497                 schedule_delayed_work(&tty->buf.work, 1);
3498 }
3499
3500 EXPORT_SYMBOL(tty_flip_buffer_push);
3501
3502
3503 /**
3504  *      initialize_tty_struct
3505  *      @tty: tty to initialize
3506  *
3507  *      This subroutine initializes a tty structure that has been newly
3508  *      allocated.
3509  *
3510  *      Locking: none - tty in question must not be exposed at this point
3511  */
3512
3513 static void initialize_tty_struct(struct tty_struct *tty)
3514 {
3515         memset(tty, 0, sizeof(struct tty_struct));
3516         tty->magic = TTY_MAGIC;
3517         tty_ldisc_assign(tty, tty_ldisc_get(N_TTY));
3518         tty->pgrp = -1;
3519         tty->overrun_time = jiffies;
3520         tty->buf.head = tty->buf.tail = NULL;
3521         tty_buffer_init(tty);
3522         INIT_DELAYED_WORK(&tty->buf.work, flush_to_ldisc);
3523         init_MUTEX(&tty->buf.pty_sem);
3524         mutex_init(&tty->termios_mutex);
3525         init_waitqueue_head(&tty->write_wait);
3526         init_waitqueue_head(&tty->read_wait);
3527         INIT_WORK(&tty->hangup_work, do_tty_hangup);
3528         mutex_init(&tty->atomic_read_lock);
3529         mutex_init(&tty->atomic_write_lock);
3530         spin_lock_init(&tty->read_lock);
3531         INIT_LIST_HEAD(&tty->tty_files);
3532         INIT_WORK(&tty->SAK_work, NULL);
3533 }
3534
3535 /*
3536  * The default put_char routine if the driver did not define one.
3537  */
3538
3539 static void tty_default_put_char(struct tty_struct *tty, unsigned char ch)
3540 {
3541         tty->driver->write(tty, &ch, 1);
3542 }
3543
3544 static struct class *tty_class;
3545
3546 /**
3547  *      tty_register_device - register a tty device
3548  *      @driver: the tty driver that describes the tty device
3549  *      @index: the index in the tty driver for this tty device
3550  *      @device: a struct device that is associated with this tty device.
3551  *              This field is optional, if there is no known struct device
3552  *              for this tty device it can be set to NULL safely.
3553  *
3554  *      Returns a pointer to the struct device for this tty device
3555  *      (or ERR_PTR(-EFOO) on error).
3556  *
3557  *      This call is required to be made to register an individual tty device
3558  *      if the tty driver's flags have the TTY_DRIVER_DYNAMIC_DEV bit set.  If
3559  *      that bit is not set, this function should not be called by a tty
3560  *      driver.
3561  *
3562  *      Locking: ??
3563  */
3564
3565 struct device *tty_register_device(struct tty_driver *driver, unsigned index,
3566                                    struct device *device)
3567 {
3568         char name[64];
3569         dev_t dev = MKDEV(driver->major, driver->minor_start) + index;
3570
3571         if (index >= driver->num) {
3572                 printk(KERN_ERR "Attempt to register invalid tty line number "
3573                        " (%d).\n", index);
3574                 return ERR_PTR(-EINVAL);
3575         }
3576
3577         if (driver->type == TTY_DRIVER_TYPE_PTY)
3578                 pty_line_name(driver, index, name);
3579         else
3580                 tty_line_name(driver, index, name);
3581
3582         return device_create(tty_class, device, dev, name);
3583 }
3584
3585 /**
3586  *      tty_unregister_device - unregister a tty device
3587  *      @driver: the tty driver that describes the tty device
3588  *      @index: the index in the tty driver for this tty device
3589  *
3590  *      If a tty device is registered with a call to tty_register_device() then
3591  *      this function must be called when the tty device is gone.
3592  *
3593  *      Locking: ??
3594  */
3595
3596 void tty_unregister_device(struct tty_driver *driver, unsigned index)
3597 {
3598         device_destroy(tty_class, MKDEV(driver->major, driver->minor_start) + index);
3599 }
3600
3601 EXPORT_SYMBOL(tty_register_device);
3602 EXPORT_SYMBOL(tty_unregister_device);
3603
3604 struct tty_driver *alloc_tty_driver(int lines)
3605 {
3606         struct tty_driver *driver;
3607
3608         driver = kmalloc(sizeof(struct tty_driver), GFP_KERNEL);
3609         if (driver) {
3610                 memset(driver, 0, sizeof(struct tty_driver));
3611                 driver->magic = TTY_DRIVER_MAGIC;
3612                 driver->num = lines;
3613                 /* later we'll move allocation of tables here */
3614         }
3615         return driver;
3616 }
3617
3618 void put_tty_driver(struct tty_driver *driver)
3619 {
3620         kfree(driver);
3621 }
3622
3623 void tty_set_operations(struct tty_driver *driver,
3624                         const struct tty_operations *op)
3625 {
3626         driver->open = op->open;
3627         driver->close = op->close;
3628         driver->write = op->write;
3629         driver->put_char = op->put_char;
3630         driver->flush_chars = op->flush_chars;
3631         driver->write_room = op->write_room;
3632         driver->chars_in_buffer = op->chars_in_buffer;
3633         driver->ioctl = op->ioctl;
3634         driver->set_termios = op->set_termios;
3635         driver->throttle = op->throttle;
3636         driver->unthrottle = op->unthrottle;
3637         driver->stop = op->stop;
3638         driver->start = op->start;
3639         driver->hangup = op->hangup;
3640         driver->break_ctl = op->break_ctl;
3641         driver->flush_buffer = op->flush_buffer;
3642         driver->set_ldisc = op->set_ldisc;
3643         driver->wait_until_sent = op->wait_until_sent;
3644         driver->send_xchar = op->send_xchar;
3645         driver->read_proc = op->read_proc;
3646         driver->write_proc = op->write_proc;
3647         driver->tiocmget = op->tiocmget;
3648         driver->tiocmset = op->tiocmset;
3649 }
3650
3651
3652 EXPORT_SYMBOL(alloc_tty_driver);
3653 EXPORT_SYMBOL(put_tty_driver);
3654 EXPORT_SYMBOL(tty_set_operations);
3655
3656 /*
3657  * Called by a tty driver to register itself.
3658  */
3659 int tty_register_driver(struct tty_driver *driver)
3660 {
3661         int error;
3662         int i;
3663         dev_t dev;
3664         void **p = NULL;
3665
3666         if (driver->flags & TTY_DRIVER_INSTALLED)
3667                 return 0;
3668
3669         if (!(driver->flags & TTY_DRIVER_DEVPTS_MEM)) {
3670                 p = kmalloc(driver->num * 3 * sizeof(void *), GFP_KERNEL);
3671                 if (!p)
3672                         return -ENOMEM;
3673                 memset(p, 0, driver->num * 3 * sizeof(void *));
3674         }
3675
3676         if (!driver->major) {
3677                 error = alloc_chrdev_region(&dev, driver->minor_start, driver->num,
3678                                                 (char*)driver->name);
3679                 if (!error) {
3680                         driver->major = MAJOR(dev);
3681                         driver->minor_start = MINOR(dev);
3682                 }
3683         } else {
3684                 dev = MKDEV(driver->major, driver->minor_start);
3685                 error = register_chrdev_region(dev, driver->num,
3686                                                 (char*)driver->name);
3687         }
3688         if (error < 0) {
3689                 kfree(p);
3690                 return error;
3691         }
3692
3693         if (p) {
3694                 driver->ttys = (struct tty_struct **)p;
3695                 driver->termios = (struct ktermios **)(p + driver->num);
3696                 driver->termios_locked = (struct ktermios **)(p + driver->num * 2);
3697         } else {
3698                 driver->ttys = NULL;
3699                 driver->termios = NULL;
3700                 driver->termios_locked = NULL;
3701         }
3702
3703         cdev_init(&driver->cdev, &tty_fops);
3704         driver->cdev.owner = driver->owner;
3705         error = cdev_add(&driver->cdev, dev, driver->num);
3706         if (error) {
3707                 unregister_chrdev_region(dev, driver->num);
3708                 driver->ttys = NULL;
3709                 driver->termios = driver->termios_locked = NULL;
3710                 kfree(p);
3711                 return error;
3712         }
3713
3714         if (!driver->put_char)
3715                 driver->put_char = tty_default_put_char;
3716         
3717         list_add(&driver->tty_drivers, &tty_drivers);
3718         
3719         if ( !(driver->flags & TTY_DRIVER_DYNAMIC_DEV) ) {
3720                 for(i = 0; i < driver->num; i++)
3721                     tty_register_device(driver, i, NULL);
3722         }
3723         proc_tty_register_driver(driver);
3724         return 0;
3725 }
3726
3727 EXPORT_SYMBOL(tty_register_driver);
3728
3729 /*
3730  * Called by a tty driver to unregister itself.
3731  */
3732 int tty_unregister_driver(struct tty_driver *driver)
3733 {
3734         int i;
3735         struct ktermios *tp;
3736         void *p;
3737
3738         if (driver->refcount)
3739                 return -EBUSY;
3740
3741         unregister_chrdev_region(MKDEV(driver->major, driver->minor_start),
3742                                 driver->num);
3743
3744         list_del(&driver->tty_drivers);
3745
3746         /*
3747          * Free the termios and termios_locked structures because
3748          * we don't want to get memory leaks when modular tty
3749          * drivers are removed from the kernel.
3750          */
3751         for (i = 0; i < driver->num; i++) {
3752                 tp = driver->termios[i];
3753                 if (tp) {
3754                         driver->termios[i] = NULL;
3755                         kfree(tp);
3756                 }
3757                 tp = driver->termios_locked[i];
3758                 if (tp) {
3759                         driver->termios_locked[i] = NULL;
3760                         kfree(tp);
3761                 }
3762                 if (!(driver->flags & TTY_DRIVER_DYNAMIC_DEV))
3763                         tty_unregister_device(driver, i);
3764         }
3765         p = driver->ttys;
3766         proc_tty_unregister_driver(driver);
3767         driver->ttys = NULL;
3768         driver->termios = driver->termios_locked = NULL;
3769         kfree(p);
3770         cdev_del(&driver->cdev);
3771         return 0;
3772 }
3773 EXPORT_SYMBOL(tty_unregister_driver);
3774
3775 dev_t tty_devnum(struct tty_struct *tty)
3776 {
3777         return MKDEV(tty->driver->major, tty->driver->minor_start) + tty->index;
3778 }
3779 EXPORT_SYMBOL(tty_devnum);
3780
3781 void proc_clear_tty(struct task_struct *p)
3782 {
3783         spin_lock_irq(&p->sighand->siglock);
3784         p->signal->tty = NULL;
3785         spin_unlock_irq(&p->sighand->siglock);
3786 }
3787 EXPORT_SYMBOL(proc_clear_tty);
3788
3789 void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3790 {
3791         if (tty) {
3792                 tty->session = process_session(tsk);
3793                 tty->pgrp = process_group(tsk);
3794         }
3795         tsk->signal->tty = tty;
3796         tsk->signal->tty_old_pgrp = 0;
3797 }
3798
3799 void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty)
3800 {
3801         spin_lock_irq(&tsk->sighand->siglock);
3802         __proc_set_tty(tsk, tty);
3803         spin_unlock_irq(&tsk->sighand->siglock);
3804 }
3805
3806 struct tty_struct *get_current_tty(void)
3807 {
3808         struct tty_struct *tty;
3809         WARN_ON_ONCE(!mutex_is_locked(&tty_mutex));
3810         tty = current->signal->tty;
3811         /*
3812          * session->tty can be changed/cleared from under us, make sure we
3813          * issue the load. The obtained pointer, when not NULL, is valid as
3814          * long as we hold tty_mutex.
3815          */
3816         barrier();
3817         return tty;
3818 }
3819 EXPORT_SYMBOL_GPL(get_current_tty);
3820
3821 /*
3822  * Initialize the console device. This is called *early*, so
3823  * we can't necessarily depend on lots of kernel help here.
3824  * Just do some early initializations, and do the complex setup
3825  * later.
3826  */
3827 void __init console_init(void)
3828 {
3829         initcall_t *call;
3830
3831         /* Setup the default TTY line discipline. */
3832         (void) tty_register_ldisc(N_TTY, &tty_ldisc_N_TTY);
3833
3834         /*
3835          * set up the console device so that later boot sequences can 
3836          * inform about problems etc..
3837          */
3838 #ifdef CONFIG_EARLY_PRINTK
3839         disable_early_printk();
3840 #endif
3841         call = __con_initcall_start;
3842         while (call < __con_initcall_end) {
3843                 (*call)();
3844                 call++;
3845         }
3846 }
3847
3848 #ifdef CONFIG_VT
3849 extern int vty_init(void);
3850 #endif
3851
3852 static int __init tty_class_init(void)
3853 {
3854         tty_class = class_create(THIS_MODULE, "tty");
3855         if (IS_ERR(tty_class))
3856                 return PTR_ERR(tty_class);
3857         return 0;
3858 }
3859
3860 postcore_initcall(tty_class_init);
3861
3862 /* 3/2004 jmc: why do these devices exist? */
3863
3864 static struct cdev tty_cdev, console_cdev;
3865 #ifdef CONFIG_UNIX98_PTYS
3866 static struct cdev ptmx_cdev;
3867 #endif
3868 #ifdef CONFIG_VT
3869 static struct cdev vc0_cdev;
3870 #endif
3871
3872 /*
3873  * Ok, now we can initialize the rest of the tty devices and can count
3874  * on memory allocations, interrupts etc..
3875  */
3876 static int __init tty_init(void)
3877 {
3878         cdev_init(&tty_cdev, &tty_fops);
3879         if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
3880             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
3881                 panic("Couldn't register /dev/tty driver\n");
3882         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 0), "tty");
3883
3884         cdev_init(&console_cdev, &console_fops);
3885         if (cdev_add(&console_cdev, MKDEV(TTYAUX_MAJOR, 1), 1) ||
3886             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 1), 1, "/dev/console") < 0)
3887                 panic("Couldn't register /dev/console driver\n");
3888         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 1), "console");
3889
3890 #ifdef CONFIG_UNIX98_PTYS
3891         cdev_init(&ptmx_cdev, &ptmx_fops);
3892         if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
3893             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
3894                 panic("Couldn't register /dev/ptmx driver\n");
3895         device_create(tty_class, NULL, MKDEV(TTYAUX_MAJOR, 2), "ptmx");
3896 #endif
3897
3898 #ifdef CONFIG_VT
3899         cdev_init(&vc0_cdev, &console_fops);
3900         if (cdev_add(&vc0_cdev, MKDEV(TTY_MAJOR, 0), 1) ||
3901             register_chrdev_region(MKDEV(TTY_MAJOR, 0), 1, "/dev/vc/0") < 0)
3902                 panic("Couldn't register /dev/tty0 driver\n");
3903         device_create(tty_class, NULL, MKDEV(TTY_MAJOR, 0), "tty0");
3904
3905         vty_init();
3906 #endif
3907         return 0;
3908 }
3909 module_init(tty_init);